LLM Agents in Zero-Day Cyberdefense

• LLM agents in zero-day cyberdefense are autonomous systems that identify and counter unknown vulnerabilities by leveraging formal models of inherent agent weaknesses.
• Hybrid detection architectures merge LLM-powered semantic analysis with traditional signature and anomaly methods to significantly improve threat detection and reduce false positives.
• Multi-agent and automated incident response frameworks use coordinated agents and real-time feedback to swiftly adapt defenses against evolving zero-day attacks.

LLM agents ("LLM agents") are emerging as autonomous or semi-autonomous entities deployed in cyberdefense infrastructures, tasked with identifying, neutralizing, or mitigating zero-day threats—exploits or vulnerabilities previously unknown to the defender and thus unaddressed by traditional threat intelligence or signature-based approaches. Research at the intersection of agentic LLM architectures, automated software and network analysis, deception techniques, and real-time cyber operations is transforming both the theoretical foundations and practical toolkit of zero-day cyberdefense.

1. Formal Models of LLM Vulnerabilities and Defensive Exploitation

LLM agents, when used for or against cyber defense, inherit specific algorithmic vulnerabilities that can be formally modeled and systematically targeted for defense. Four principal weaknesses are identified: population-level conditional bias, uncritical trust in the presented input sequence, memory limitations imposed by finite context length, and tunnel-vision depth-first problem-solving. Each can be codified mathematically:

• Bias: Given an input $x$ and output vocabulary $\mathcal{Y}$, the model distributes $P(y|x)$ compared to a ground-truth $Q^*(y|x)$. Defender-side exploits involve overloading the agent’s context with plausible but misleading attack vectors, leading to wasted adversarial effort. Bias divergence is measured as $D_{KL}(P(\cdot|x)\|\ Q^*(\cdot|x))$ (Ayzenshteyn et al., 2024).
• Blind Trust: LLMs generally infer $P(T|I) \approx 1$ for any prompt history $I$, ignoring probabilistic relationships with the true state $T$. Defenders can seed assets and logs with subtle luring payloads to redirect or trap attacker LLMs.
• Limited Memory: Using an effective context decay model $H_n = \sum_{k=1}^n \alpha^{n-k}I_k$ with $0<\alpha<1$, early context injections are rapidly forgotten, enabling defender “trash+reload” loops that induce hallucinated states or erase prior instructions.
• Tunnel-Vision: At each step, LLM agents optimize $a^* = \arg\max_{a\in A(h)} s(a|h)$, where $A(h)$ is the set of currently available actions and $s(\cdot|h)$ is the scoring function. By introducing cyclic or spurious high-score branches, defenders can manipulate the agent’s search trajectory, amplifying expected search depth and operational delay.

Defensive strategies are encoded as routines—payload overwhelming, luring, context poisoning, and cyclic reference creation—which, when injected into assets or environmental artifacts, degrade or defeat automated LLM-driven attacks. These methods are effective even against zero-day attacks, as they target the generic decision process rather than known exploit chains. In experimental CTF environments, layered application of these defenses led to single-prompt black-box success rates ranging from 68% to 100% depending on model and scenario, with induced delays frequently doubling attack times (Ayzenshteyn et al., 2024).

2. Hybrid LLM-Driven and Classical Detection for Zero-Day Threats

The integration of LLM-based semantic analysis with legacy signature and anomaly detection techniques underpins next-generation intrusion detection systems (IDS), especially for complex, heterogenous settings such as IoT networks (Al-Hammouri et al., 10 Jul 2025). The representative architecture consists of three detection modules: signature-based ($S_{\text{sig}}(x)$), anomaly-based ($S_{\text{ana}}(x)$), and LLM-powered semantic anomaly scoring ($S_{\text{sem}}(x)$).

• The LLM (e.g., GPT-2) consumes preprocessed, tokenized IoT logs, outputting token-level likelihoods and, via logistic mapping, a probability of anomalous (potentially malicious) behavior.
• Decision-level fusion applies max-rules or weighted summation to derive an overall detection verdict $S_{\text{hyb}}(x)$.
• Fine-tuning the LLM on labeled log data using the combined loss $L_{\text{total}} = L_{LM} + \lambda L_{\text{cls}}$ enables adaptation to new syntax and traffic patterns.

Empirical validation demonstrates substantial improvements in both detection accuracy (from 92.0% baseline to 98.3% hybrid) and false-positive reduction (from 11.5% to 2.5%). The LLM module contributes robust, context-aware anomaly detection, flagging semantically novel attack patterns of the kind prevalent in zero-day scenarios—for instance, subtle distributed port scans or coordinated malicious traffic clusters that do not match any preexisting signature (Al-Hammouri et al., 10 Jul 2025).

Real-time constraints are addressed by quantization, pruning, and distillation to produce compact models for edge deployment. Remaining research foci include adversarial robustness, continual fine-tuning, and integration with automated mitigation/response agents.

3. Multi-Agent and Self-Reflective Defense Architectures

Multi-agent LLM systems, characterized by explicit role separation and layered checking, have been shown to offer superior resistance to zero-day and adversarial threats compared to monolithic, prompt-tuned models (Cai et al., 29 Apr 2025). In AegisLLM, four coordinated agents—Orchestrator, Responder, Evaluator, Deflector—process and validate each query at inference time, with two independently parameterized classifiers (Orchestrator, Evaluator) for pre- and post-response filtration.

Adaptation to novel (zero-day) attack patterns is performed entirely at runtime using prompt optimization via Bayesian black-box search (e.g., DSPy), avoiding any retraining of the underlying model. When either classifier or the downstream Evaluator signature detects a threat, an immediate deflection or refusal is issued. Observed failures are catalogued, and agent prompts are incrementally updated to assimilate new attack patterns, yielding rapid adaptation—refusal rates on novel attacks rising from near-0% to over 60% with under 15 examples, outpacing adversarial retraining baselines (Cai et al., 29 Apr 2025).

Strengths of this approach include modular defense against prompt-injection/jailbreaking and near-zero penalty on model utility for benign queries. Limitations are the need for continual prompt augmentation, minor inference penalty due to layered agent calls, and lack of formal detection guarantees.

4. Automated Vulnerability Analysis and Experience-Driven Zero-Day Response

Agentic LLM frameworks now incorporate explicit program analysis, code-understanding, multi-agent planning, memory, and execution feedback for end-to-end vulnerability discovery, patching, and incident response. Representative systems such as Co-RedTeam (He et al., 2 Feb 2026) and ZeroDayBench (Lau et al., 2 Mar 2026) implement multi-stage pipelines:

• Discovery Stage: Analysis agents perform code-browsing, taint/data-flow annotation, and semantic retrieval of CWE/OWASP patterns. Critique agents independently validate or request refinements.
• Exploitation/Defense Stage: Planner, Validation, and Execution agents compose and verify exploit or patch plans in a sandboxed environment, using execution feedback to iteratively refine decisions.
• Long-Term Memory: Pattern, strategy, and technical memory modules enable reuse of exploitation/defense trajectories, accelerating detection and mitigation on subsequent zero-day exposures.

Quantitative benchmarks indicate 63.7% exploitation success rates and >10% improved detection accuracy over single-agent or non-execution-grounded competitors. Notably, ablation of memory or feedback components sharply decreases efficacy (memory removal: –9.1%, execution feedback removal: –41.6% on CyBench) (He et al., 2 Feb 2026). ZeroDayBench (Lau et al., 2 Mar 2026) reveals that as information specificity increases, so does LLM agent success (zero-day: 12–14% pass; full-info: >75%), underscoring the need for static analysis, in-loop dynamic feedback, and agent chaining for real-world zero-day resilience.

5. LLM Agents for Autonomous Incident Response

Recent architectures embed incident response as an in-context, single-agent planning loop using large transformer models fine-tuned for perception, reasoning, planning, and action (Gao et al., 13 Feb 2026). Using chain-of-thought prompts and lookahead simulation, such agents ingest raw logs, infer plausible adversarial tactics, simulate counterfactual incident trajectories, and propose optimized response sequences.

Attack conjecture and adaptation is formalized via a Bayesian-style model update: after each action and observed alert, a candidate set of tactics $\Theta$ is re-estimated according to a cost function (e.g., $L(\theta) = D_1[o_{t+1} \| \hat{o}_{t+1}(\theta)]$). Planning modules employ MCTS, and recovery time ($J(s_0)$) and terminal-state attainment serve as empirical metrics. In benchmarking, these systems demonstrate incident recovery times 23% faster than prior 14B LLM baselines without requiring explicit simulation modeling or CVE signatures (Gao et al., 13 Feb 2026).

Scaling issues (tree search complexity), lack of deep sequence modeling, and efficient fusion of external threat intelligence remain key areas for progression.

6. Energy-Efficient, Binary-Free Zero-Day Vulnerability Detection in IoT Firmware

In scenarios where binary access is unavailable (e.g., encrypted or proprietary IoT firmware), tri-LLM reasoning architectures have been proposed, combining configuration interpretation, structural abstraction, and semantic fusion (Jamshidi et al., 23 Dec 2025). The pipeline operates on descriptor-only inputs $(m, c, o)$ and fuses them via learned embedding spaces, with risk scoring coupled to divergence and energy consumption metrics.

Key theoretical properties include:

• Monotonicity of divergence-to-risk $\frac{\partial P(Z=1|f)}{\partial \mathcal{D}} > 0$, ensuring semantic inconsistency amplifies zero-day likelihood.
• Strict convexity in misalignment energy ensures existence and uniqueness of minimal-risk predictors per sample.
• Layerwise symbolic load maps (latency, compute, token flow) are directly linked to risk, supporting IoT constraint compliance.

Simulation results show that exposure-increasing perturbations raise predicted zero-day likelihood by 20–35%, with all cross-model and cross-layer correlations statistically significant at $p<0.01$ (Jamshidi et al., 23 Dec 2025). These findings establish the feasibility of explainable, resource-aware, multi-view LLM agents for blind-spot detection in embedded device security.

7. Research Frontiers and Practical Integration

Across the state of the art, LLM agents in zero-day cyberdefense are transitioning from reactive signature-matching toward proactive, adaptive, and semantically informed defense. Defenses that exploit LLM-specific inductive biases are effective for generic resilience against unseen threats, as demonstrated by up to 90% success in neutralizing autonomous LLM attackers using deception and context manipulation (Ayzenshteyn et al., 2024).

Hybrid systems leveraging deep semantic anomaly detection, prompt-optimized multi-agent orchestration, and structured memory/feedback significantly outperform monolithic prompt-tuned LLMs, particularly in zero-day code patching and automated macro/malware analysis (Edwards et al., 10 Mar 2026, Lau et al., 2 Mar 2026). In operational pipelines, formal mathematical properties—monotonicity, convexity, and energy coupling—enable interpretable model behavior, critical for deployment in resource-constrained and high-risk environments (Jamshidi et al., 23 Dec 2025).

Ongoing challenges include efficient adaptation to adversarial LLM evolution, formalizing guarantees for dynamic agent hierarchies, continual federated learning in privacy-sensitive domains, and robust handling of adversarial evasion or poisoning. The synthesis of defense-in-depth techniques, rapid prompt adaptation, and semantic reasoning positions LLM agents as foundational components of future zero-day cyberdefense platforms.