SanMuzZzZz/LuaN1aoAgent
LuaN1aoAgent is a fully autonomous AI penetration testing agent driven by graph-based cognitive reasoning, developed by postgraduate researchers from Prof. Lu Hui's Intelligent Offensive and Defensive Security Team at the Institute of Cyberspace Security, Guangzhou University.
What it solves
LuaN1aoAgent v2 automates authorized security research by moving beyond simple linear task lists. It addresses the need for traceability and complex decision-making in autonomous pentesting by ensuring every conclusion is linked to verifiable evidence rather than just hidden in LLM conversation history.
How it works
The system uses a specialized P-E-O architecture:
- Planner: Manages goals, task dependencies, and scheduling using a dynamic task graph.
- Executor: Operates in an isolated sandbox (Docker, macOS Seatbelt, or Linux Bubblewrap) to perform specific tasks using tools like web searching, browser rendering, and shell execution.
- Observer: Uses a Supervisor to monitor actions and a Projector to asynchronously convert observations into a causal reasoning graph.
The agent uses Causal Graph Reasoning to link evidence to hypotheses, vulnerabilities, and exploits, ensuring all findings are backed by traceable events.
Who it’s for
Security researchers and penetration testers looking for an autonomous agent capable of performing complex, multi-step security assessments within a controlled, observable, and sandboxed environment.
Highlights
- Causal Reasoning Graph: Connects evidence, hypotheses, vulnerabilities, and exploits in a traceable chain.
- Plan-on-Graph: Uses a dependency-aware task graph that allows for local adaptation instead of regenerating entire plans.
- Sandboxed Execution: Provides high-fidelity isolation via Docker or native OS security frameworks.
- Observability: Offers both a Terminal TUI and a Web Workbench to inspect reasoning, actions, and artifacts in real-time.