LATIDIA · Ciberseguridad

PentestChain: un marco organizado por MCP y consciente de los costos para pruebas de penetración automatizadas con LLM de nivel libre

arXiv: 2609.18120v1Tipo de anuncio: nuevo Resumen: las pruebas de penetración impulsadas por IA se han demostrado con modelos de frontera premium como GPT-4, pero el costo del token por compromiso hace que las pruebas continuas y automatizadas no sean seguras

La noticia

arXiv:2609.18120v1 Announce Type: new Abstract: AI-driven penetration testing has been demonstrated with premium frontier models such as GPT-4, but the per-engagement token cost makes continuous, automated testing unaffordable for the smaller organisations that need it most. This paper presents PentestChain, a ten-phase automated penetration testing framework that couples a curated, deterministic exploit map with a cost-aware AI cascade-a local Ollama model (qwen2.5-7b) first, then free-tier OpenRouter and Cerebras, with a rule-based fallback that always produces output-and exposes the full pipeline through a Model Context Protocol (MCP) server with eleven tools. We make three contributions. First, we treat US-dollar cost per engagement as a measured, first-class evaluation metric and show that