Abstract

Penetration testing constitutes a resource-intensive yet indispensable component of modern network security. Although large language models (LLMs) have demonstrated substantial potential in automating security auditing, existing LLM-driven agents remain largely confined to executing end-to-end workflows within simplified, linear scenarios. Real-world black-box engagements are fundamentally different: the underlying attack graph is initially unknown and must be incrementally constructed from environmental feedback. Each observation may expose multiple plausible attack branches, failures are often semantically ambiguous, and decisive clues may be separated by vast action horizons. Consequently, current autonomous agents repeatedly fall into depth-first traps, misattribute failures, and forget previously discovered evidence. We present MazeRunner, an autonomous penetration testing system based on a three-agent task and clue orchestration framework. MazeRunner separates global task orchestration, context-intensive execution, and failure-oriented review, while maintaining task states and environmental evidence in a persistent Task & Clue Cache. This design enables the system to revise failed actions, recover missing prerequisites, switch between attack branches, and correlate clues across distant execution stages. We evaluate MazeRunner on 10 recently released Hack The Box targets under a common budget of 20 million LLM tokens per systemtarget run and a protocol designed to prevent target-specific solution leakage. With Claude Sonnet 4.5, MazeRunner completes 47.7% of the annotated subtasks, compared with 36.2% for PentestGPT-V2 and 34.2% for Claude Code. MazeRunner obtains user-level or higher access on 6 targets, including root access on 2, whereas each same-model baseline obtains user-level access on 2 targets and fails to reach root access. Analysis of the complete execution traces further shows that MazeRunner explores a broader range of attack branches and achieves higher shell-acquisition efficiency per token than the same-model baselines.