Mutate to Bypass: Autonomous Endpoint Evasion via Knowledge-Driven Multi-Agent Orchestration

arXiv:2608.01639 · cs.CR, cs.OS · Submitted 2026-08-03 · Read on arXiv

Weifeng Yuan, Wenbo Guo, Qingyun Du, Jun Chen, Feng Dong, Haoyu Wang, Yang Liu

cs.CR, cs.OS

Submitted: 2026-08-03

Code: https://github.com/BishopFox/sliver

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Ablation — 9× in this paper · explained in 1 episode
• Core — 8× in this paper · explained in 2 episodes
• Detection-Aware Knowledge Base — 8× in this paper
• Provenance — 7× in this paper · explained in 5 episodes
• Obfuscation — 6× in this paper · explained in 2 episodes
• Ablation Study — 5× in this paper · explained in 3 episodes
• Endpoint Detection and Response — 5× in this paper
• Actor — 4× in this paper · explained in 3 episodes
• Adam — 4× in this paper · explained in 3 episodes
• Iterative Refinement — 4× in this paper · explained in 5 episodes
• Machine Learning — 3× in this paper
• Multi-Agent Architecture — 3× in this paper · explained in 2 episodes
• Robustness — 3× in this paper · explained in 6 episodes
• Accuracy — 2× in this paper · explained in 1 episode
• Agentic Reasoning — 2× in this paper · explained in 2 episodes
• Benchmark — 2× in this paper · explained in 2 episodes
• Embeddings — 2× in this paper · explained in 2 episodes
• Generalizability — 2× in this paper · explained in 6 episodes
• Hallucination — 2× in this paper · explained in 4 episodes
• Ablation Studies — 1× in this paper · explained in 1 episode
• Adversarial Examples — 1× in this paper · explained in 2 episodes
• Closed-Loop System — 1× in this paper · explained in 4 episodes
• Commentary — 1× in this paper · explained in 2 episodes
• Computational overhead — 1× in this paper · explained in 2 episodes
• Consistency — 1× in this paper · explained in 3 episodes
• Data Provenance — 1× in this paper · explained in 3 episodes
• Evaluation Protocol — 1× in this paper · explained in 2 episodes
• Feedback Loop — 1× in this paper · explained in 2 episodes
• Fidelity — 1× in this paper · explained in 2 episodes
• Grounding — 1× in this paper · explained in 3 episodes
• Knowledge Base Construction — 1× in this paper · explained in 2 episodes
• Localization — 1× in this paper · explained in 2 episodes
• Machine Learning (ML) — 1× in this paper · explained in 2 episodes
• Minimum Viable Product — 1× in this paper
• Multi-Agent Framework — 1× in this paper · explained in 3 episodes
• Performance Gap — 1× in this paper · explained in 2 episodes
• Redundancy — 1× in this paper · explained in 2 episodes
• Reinforcement Learning — 1× in this paper · explained in 4 episodes
• Trace — 1× in this paper · explained in 2 episodes
• Verification — 1× in this paper · explained in 2 episodes

Sources

• HookChain: A new perspective for Bypassing EDR Solutions
• MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots
• LLM Agents can Autonomously Exploit One-day Vulnerabilities
• IntelliRadar: A Comprehensive Platform to Pinpoint Malicious Package Information from Cyber Intelligence
• Bridging Expert Reasoning and LLM Detection: A Knowledge-Driven Framework for Malicious Packages
• UNICORN: Runtime Provenance-Based Detector for Advanced Persistent Threats

Related papers

• SoK: AI-Augmented Binary Reversing
• Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
• Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
• Estimating the Social Cost of Corporate Data Breaches
• Efficient Fuzzy PSI under One-Sided Assumptions
• Sealing the Audit-Runtime Gap for LLM Skills