PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation

Yixuan Liu, Zilong Zhen, Yin Wu, and Yi Li

In Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS), 2026

Abstract: As Large Language Model (LLM) agents increasingly automate offensive operations across the cyber kill chain, their efficacy in complex local post-exploitation tasks remains inadequately quantified. Among these, Linux privilege escalation is a key step between initial access and full system compromise. However, existing evaluations for this task are limited by small sample sizes (<15 scenarios), lacking the scale to distinguish genuine reasoning from pattern memorization. To address this, we present PrivEscalate, the most comprehensive benchmark to date for Linux privilege escalation, comprising 531 Dockerized scenarios spanning 14 distinct sub-categories. To probe generalization, we additionally derive 154 parameterized variant scenarios that inject distractors and environmental noise to test whether LLMs genuinely reason about exploitation or rely on surface-level pattern matching. Evaluating four closed-source and two open-weight LLMs reveals: (i) Model capability is heterogeneous across vulnerability categories, with no single model dominating all categories, necessitating multi-dimensional risk assessments. (ii) LLMs are fragile under environmental perturbation, with only one of six models generalizing across variants, making configuration rotation effective against most models but only a partial defense against top-tier ones. (iii) Agent architectures can amplify risk across models. Leveraging these insights, we develop PrivEscAgent, a domain-specialized wrapper that augments a generic ReAct agent with deterministic enumeration, category matching, and step planning. PrivEscAgent improves over the prior Linux privilege-escalation baseline (hackingBuddyGPT) by 34 percentage points and elevates the weakest evaluated model above that baseline without underlying LLM modifications. We release PrivEscalate as an open-source, Dockerized measurement instrument supporting both LLM agent evaluation and broader Linux privilege escalation research, including defensive tool validation and red-team training.

Cite:

@inproceedings{Liu2026PMA,
  author = {Liu, Yixuan and Zhen, Zilong and Wu, Yin and Li, Yi},
  booktitle = {Proceedings of the 33rd ACM Conference on Computer and Communications Security (CCS)},
  month = nov,
  title = {{PrivEscalate}: Measuring and Augmenting the Threat of {LLM}-Automated {Linux} Privilege Escalation},
  year = {2026}
}