Thesis: Hack Yourself First: Autonomous LLM Agents for Continuous Penetration Testing

Internal networks can contain overlooked weaknesses, while conventional penetration testing is often too infrequent to keep up with system changes. This thesis explores whether autonomous LLM agents can support continuous network security testing by identifying and exploiting vulnerabilities in an authorised test environment. It will assess both the usefulness of their reports and the risks of allowing agents to operate independently.

The assignment

• Develop a proof of concept using existing models, with an agent operating from a single jump host in a test environment containing known vulnerabilities.
• Evaluate an autonomous workflow covering reconnaissance, vulnerability identification, exploitation and reporting, measuring detection and exploitation rates as well as execution time.
• Compare reported findings with the environment’s known vulnerabilities and assess false positives and report usefulness.
• Investigate whether multi-agent orchestration can verify findings.
• Examine unsafe agent behaviour and whether cloned environments or sandboxing can reduce operational risks.
• Limit testing to authorised targets under a defined threat model, focusing on known vulnerabilities and common weaknesses rather than zero-day discovery.

Who we are looking for

• Studying towards a bachelor’s or master’s degree in computer science, computer engineering or a related discipline, with graduation planned for June 2027.
• Fluent in both Swedish and English, in speech and writing.
• An interest in cybersecurity and artificial intelligence is an advantage.

What we offer

• An experimental thesis project at Knightec Group, a company working with product and digital service development.
• An opportunity to produce proof-of-concept results that could inform a future solution for businesses.

Practical details

Based at the Sundsvall office, starting in January or March 2027. Apply through the company’s careers page as soon as possible, no later than 30 November 2026. Questions can be sent to johanna.edstrom@knightec.se.