Local SLM turns RAT into autonomous intruder

Problem

The paper studies agentic Remote Access Trojans (agentic RATs): conventional RATs augmented by a locally hosted Small Language Model (SLM) that closes a continuous observe-decide-act loop on an endpoint. This matters because a local SLM can reason, select actions, and adapt without cloud connectivity or a human operator, reducing network-dependent detection opportunities and potentially making intrusions more autonomous and stealthy.

Approach

The authors implemented a reproducible, network-isolated laboratory using Docker Compose: an agent container, a Kali attacker container, and a Metasploitable2 target. They served an 8-billion-parameter Dolphin-family model locally through LM Studio. A controller fed structured reconnaissance evidence from Nmap to the SLM, validated model-proposed commands, executed approved commands on Kali over SSH, parsed terminal output, and iterated until a verification criterion was met or attempts were exhausted. Runs were scored on checklist completion, efficiency, and reliability. The experiment avoided building any implant, persistence, evasion, or command-and-control; it focused solely on whether an off-the-shelf SLM can sustain the decision loop against real services and real command output.

Key Findings

• Architectural feasibility demonstrated: a local SLM on commodity hardware closed the full observe-decide-act loop with no cloud service and no operator in the loop, interpreting ranked reconnaissance and proposing executable commands.
• Operational capability limited: across three checklist runs the agent attempted 55 service-level tasks and completed 6, a 10.91% success rate; the average run score was 12.72/100 and average runtime 251.16 seconds.
• Successes were narrow and consistent: two services succeeded repeatedly (the 1524/tcp bind shell and 21/tcp FTP/vsftpd), both cases where a single inferential step transformed observation into verified shell access.
• Principal failure modes: hallucinated commands and flags, misreading terminal output, tool-to-service mismatches, commands requiring interactive input, and poor error recovery with repeated ineffective strategies rather than meaningful replanning.
• Instrumented resource use in the container was low but not representative of a deployed host: roughly 0.1 to 0.31% CPU and 35 to 47 MB RAM for the agent container.

Limitations

The study is constrained by a single vulnerable target and one model family, possible training-data overlap with Metasploitable2 so successes may reflect memorisation rather than reasoning, absence of a rule-based control ablation that would isolate the SLM's contribution, short supervised sessions rather than long-horizon operation, and no adversarial or defensive-product testing. No implant, persistence, evasion, or C2 channels were built.

Implications

An attacker could deploy agentic behaviour locally to triage and act on host information without cloud dependence, lowering the skill floor and enabling inexpensive, high-volume attempts where even a one-in-ten success rate scales into impact. Offline autonomy reduces network-based detection opportunities because decisions occur on-host. Early offensive development would most plausibly focus on improving error recovery and multi-stage planning. Defenders should note that the observed failure modes create detectable behavioural signals: chains of repeated tool invocations and dead-end loops are visible in execution telemetry and offer an avenue for detection, while audit trails and richer host sensing will be important forensic artefacts.