Network-Indirection

Network Indirection as a Fundamental Gap in LLM Agent Safety

Autonomous Exploitation via Transparent Proxy Misdirection

Paper

paper.pdf - Full research paper (arXiv preprint format)

Abstract

We identify network indirection - the insertion of a transparent forward proxy between an LLM agent and an arbitrary target - as a structural, model-agnostic safety gap that defeats all evaluated defense layers. The attack requires no jailbreak, prompt injection, or model manipulation: the agent faithfully executes benign-looking instructions against localhost while a 60-line proxy silently relays traffic to a remote victim.

In our proof-of-concept, an autonomous LLM agent (MiniMax M3), given only a localhost URL and an OWASP-methodology prompt, discovers and exploits 17 vulnerabilities across 6 OWASP Top 10 categories - including UNION-based SQL injection with full database exfiltration of PCI/PII data, authentication bypass, and persistent stored XSS - in 30 minutes (253 turns, 277 tool calls).

The architecture is model-agnostic (applicable to GPT-5, Claude, Gemini, and any tool-using LLM), supports mass-target orchestration, and extends beyond web applications to arbitrary network protocols. All six classes of existing defenses achieve 0% detection.

Key Results

Metric	Value
Vulnerabilities found	17 (5 Critical, 4 High, 5 Medium, 3 Low)
OWASP categories covered	6 of 10
Total execution time	30.2 minutes
Total turns	253
Tool calls	277
Detection rate (all defenses)	0%
Proxy complexity	60 lines TypeScript

Repository Contents

Network-Indirection/
├── README.md              ← This file
├── paper.pdf              ← Research paper (arXiv format)
├── output.json            ← Complete agent execution trace (253 turns, 10K events)
└── evidence/              ← 170 raw evidence artifacts (HTML responses, dumps, PoCs)

Files

• paper.pdf - The full paper: threat model, attack taxonomy (3 trees, 7 vectors), empirical validation, defense evaluation, supply-chain analysis, and discussion of physical system implications.

• output.json - Complete reproducibility trace from the autonomous agent session. Contains all 10,068 stream events, 277 tool calls with full request/response pairs, token usage per turn, and the final vulnerability report. This is the raw data behind every statistic in the paper.

• evidence/ - 170 HTML/text artifacts saved by the agent during exploitation: SQL injection responses, database dumps, cookie captures, XSS payloads, authentication bypass evidence, and more.

• evidence/REPORT.md - Full penetration test report generated autonomously by the LLM agent. Contains all 17 findings with OWASP category, severity rating, affected URL, proof-of-concept payloads, response evidence, and remediation guidance. This is the raw unedited output from the agent session.

Threat Model (Summary)

┌────────────┐       ┌────────────────┐       ┌────────────────-┐       ┌────────────────┐
│  Attacker  │──────▶│   LLM Agent    │──────▶│  Forward Proxy  │──────▶│  Real Target   │
│ (Operator) │       │   MiniMax M3   │       │ localhost:40300 │       │  vulnweb.com   │
└────────────┘       └────────────────┘       └────────────────-┘       └────────────────┘
                             │                         │
                             ▼                         │
                     ┌────────────────┐                │
                     │ Safety Monitor │◀─────────────-─┘
                     │  Sees: benign  │   "All 277 calls to localhost"
                     └────────────────┘

The agent observes only localhost:40300. The proxy rewrites Host headers and forwards to the real target. The safety monitor sees exclusively benign localhost traffic. The gap is structural - no amount of prompt filtering, output scanning, or reasoning analysis can detect it.

Attack Taxonomy

Three attack trees with seven vectors:

1. Indirection Surface - Localhost proxy, private-IP NAT, multi-hop chain, browser-as-recon
2. Autonomous Loop - Recon → Enumerate → Exploit → Exfiltrate → Persist (repeat)
3. Distributed Mesh - N-agent swarm, rate distribution, slow decay

Ethical Disclosure

This research targets a deliberately vulnerable application (Acunetix testaspnet.vulnweb.com) designed for security testing. No unauthorized systems were accessed. The work is disclosed to advance understanding of LLM agent safety gaps and inform defense development.

Citation

@misc{byte2026indirection,
  title={Network Indirection as a Fundamental Gap in LLM Agent Safety:
         Autonomous Exploitation via Transparent Proxy Misdirection},
  author={NeaByteLab},
  year={2026},
  howpublished={\url{https://github.com/NeaByteLab/Research/Network-Indirection}},
  note={Preprint, not peer-reviewed}
}

License

This work is licensed under CC BY-SA 4.0.