Exploit Agent — Overview
Single-target LLM loop. Canonical implementation: tools/exploit_agent/runner/_impl.py
(loaded into the package by tools/exploit_agent/runner/loop.py via importlib).
Entry point run_exploit_agent (_impl.py:301) re-exported via the
package root __init__.py after _sync_patchable_symbols (propagates
historical test monkeypatches into the split modules).
tools/exploit_agent/loop.py is a deprecated re-export shim (DeprecationWarning).
| Module | Symbol | Kind | Line |
|---|
tools/exploit_agent/runner/_impl.py | run_exploit_agent | async def | 301 |
tools/exploit_agent/runner/_impl.py | _InMemoryExperienceStore | class | 196 |
tools/exploit_agent/runner/_impl.py | CheckpointContext | dataclass | 99 |
tools/exploit_agent/runner/_impl.py | CheckpointOutcome | dataclass | 117 |
tools/exploit_agent/runner/_impl.py | CheckpointHook | Protocol | 138 |
phase_tracker.py | _PhaseTracker | class | 9 |
policy.py | ExploitPermission | Enum | 13 |
policy.py | ExploitSettings | dataclass | 24 |
policy.py | ExploitPolicy | class | 277 |
policy.py | ExploitRecord | dataclass | 143 |
context.py | sanitize_output | def | 619 |
prompt.py | build_exploit_system_prompt | def | 13 |
research_assistant.py | ResearchAssistant | class | 189 |
research_assistant.py | ResearchAssistantSettings | dataclass | 105 |
reflection.py | _generate_reflection | def | 11 |
tool_calls.py | _ToolOutcomeTracker | class | — |
tool_catalog.py | select_tools_for_phase | def | — |
| File | Role |
|---|
tools/exploit_agent/runner/_impl.py | Main loop, phase/budget/compaction/reflection wiring, checkpoints |
runner/ + runner.py | Loader + re-export shims into the package |
loop.py | Deprecated shim → runner |
phase_tracker.py | Phase minima + can_terminate() |
policy.py | Permission + budgets + tamper-evident audit chain |
context.py | Token estimation, compaction, attack memory, reasoning advisory, sanitization |
prompt.py | System prompt assembly + advisory briefings |
model_client.py | _call_model_with_retry, _stream_model, _call_model_with_tools — provider-neutral (ollama_client.py is its deprecation shim) |
tool_calls.py | Filtering/validation, _ToolOutcomeTracker, replan prompts |
tool_catalog.py | Phase-narrowed tool schemas |
reflection.py | Heuristic + LLM reflection, peer consultation |
research_assistant.py | Bounded read-only research sidecar |
skills.py | Mid-run skill re-selection |
outcome_*.py | Classification → truth normalization → judge bridge |
| Key | Effect |
|---|
exploit.permission | full_access/approve_only/read_only; missing → read_only |
exploit.attack_mode | Enables attack workflow + raised budgets |
exploit.max_rounds / max_commands_per_session / attack_max_* | Budgets via ExploitSettings.effective_* |
exploit.allowed_targets / require_explicit_allowlist | Target-IP lock (enforced in MCP layer) |
exploit.attacker_os | OS prompt branch (_resolve_attacker_os) |
long_session.* | num_ctx, checkpointing |
reasoning.* | chain_of_thought, ultrathink, llm_reflection, peer_consult_on_failure_threshold |
multi_model.* | Peer consultation budget |
research.assistant.* | ResearchAssistantSettings.from_config |
skills.* | Startup hints + reselect_* |
memory.* | attack_memory_enabled, semantic_enabled, experience_* |
models.info.<alias>.context_window | Compaction profile override (context.py:60) |
| Test file | Covers |
|---|
tests/test_agent_loop.py | Loop lifecycle, budget, phase minima |
tests/test_context_compaction.py | Compaction + token estimation |
tests/test_attack_memory.py | Attack memory capture/render |
tests/test_long_session.py | num_ctx, persist_messages |
tests/test_reasoning_loop.py | ULTRATHINK advisory |
tests/test_ultrathink.py | [REASONING] parsing |
tests/test_exploit_permission.py | Permission modes |
tests/test_audit_chain.py | Hash chain |
tests/test_tool_outcome_tracker.py | Blocked/compromise tracking |
tests/test_research_assistant.py | Research sidecar |
tests/test_skill_reselection.py | Mid-run skill update |
tests/test_outcome_truth.py | normalize_action_result |
tests/test_outcome_judge_flow_a.py | Judge bridge |
ExploitPolicy.approve_action auto-approves in full_access with no
command/scope inspection. The sole attack-mode safety is the target-IP
allowlist enforced at tools/mcp_shared._allowed_target_list +
tools/kernel/allowlist.py. See policy.md.