APEX discovers 9 previously unknown privilege escalation vectors
The claim
The authors assert that APEX can automatically find both known and post-exploitation attack chains, including 9 new privilege escalation paths
Published as: “Automated Post-Exploitation Attack Chain Exploration Based on a Phase-guided Hybrid Planning-Monte Carlo Tree Search Algorithm”
So what
APEX enables faster, more comprehensive discovery of post-exploitation attack chains, giving defenders richer intelligence to harden large cloud fleets.
The five-minute version
APEX discovered 9 previously unreported privilege-escalation attack chains in a deployment of 291 real cloud instances, achieving a 100% success rate on five CTF VMs and a 93% success rate on 30 synthetic problems. It generates multiple diverse chains (average 2.4 per VM) and solves instances 42.6% faster than the prior ChainReactor system. The evidence is based on a mix of benchmark, synthetic, and real-world evaluations, but the system only found chains in 27 of the 291 cloud instances and requires manual vulnerability capability curation.
What they found 4
- APEX identified 9 previously unreported attack chains in production cloud environments.
“APEX successfully discovered privilege escalation chains in 27 instances, comprising 19 EC2 instances (10.9%) and 8 ECS instances (6.9%). More significantly, the system identified 9 previously unreported attack chains that represent security vulnerabilities in production cloud environments.”
- APEX achieved a 100% success rate on five CTF virtual machines.
“APEX successfully discovered valid privilege escalation chains in all 5 CTF VMs, achieving a 100% success rate.”
- On synthetic problems, APEX attained a 93% success rate, far exceeding pure planner (57%) and pure MCTS (7%).
“The average success rates for the pure optimal planner, pure MCTS, and APEX were 57%(17), 7%(2), and 93%(28), respectively.”
- APEX reduced average analysis time to 14.4 minutes per instance, a 42.6% improvement over ChainReactor.
“APEX achieved an average solution time of 14.4 minutes, representing a 42.6% reduction in time overhead compared to ChainReactor.”
What undercuts it the paper’s own results
- APEX found attack chains in only 27 of 291 cloud instances (9.3% coverage).
- The average time to first solution on CTF VMs was 870.6 seconds (≈14.5 minutes), which may be too long for rapid response.
- Success on synthetic problems was 93%, not 100%, indicating occasional failure on larger instances.
Stated limits 4
- First, while our domain model captures prevalent attack vectors, it remains an abstraction. Certain advanced techniques-particularly kernel-level exploits, race conditions, or hardware-based attacks-fall outside its current scope.
- Second, our current vulnerability capability modeling requires manual curation. We manually extracted specific capabilities (e.g., arbitrary file write, command injection) from known CVEs and mapped them to executable predicates. This process is labor-intensive and cannot scale to the continuous stream of new vulnerabilities.
- Third, our current model optimizes for logical feasibility rather than operational stealth. Generated chains may contain actions likely to trigger security alerts in monitored environments.
- Fourth, APEX generates attack chains but does not automatically execute them to validate operational feasibility or collect runtime data.
What’s new here 4
- Introduces a phase-guided hybrid Planning-MCTS algorithm that combines AI planning efficiency with MCTS flexibility.
- Provides formal domain modeling of host state (files, users, permissions) for post-exploitation reasoning.
- Generates multiple feasible attack chains per target rather than stopping at the first solution.
- Integrates a large language model to translate formal attack plans into natural-language remediation reports.
Artifacts & methods 8
- APEXsystem
- Phase-guided hybrid Planning-MCTS (PG-HP-MCTS) algorithmsystem
- GTFOBins databasedataset
- Powerlifted plannersystem
- ChainReactorsystem
- Synthetic problem set (30 instances)dataset
- CTF virtual machines (5)dataset
- 291 cloud instancesdataset