AI-driven penetration testing now executes thousands of actions per hour but still lacks the strategic intuition humans apply in competitive security. To build cybersecurity superintelligence --Cybersecurity AI exceeding best human capability-such strategic intuition must be embedded into agentic reasoning processes. We present Generative Cut-the-Rope (G-CTR), a game-theoretic guidance layer that extracts attack graphs from agent's context, computes Nash equilibria with effort-aware scoring, and feeds a concise digest back into the LLM loop \emph{guiding} the agent's actions. Across five real-world exercises, G-CTR matches 70--90% of expert graph structure while running 60--245x faster and over 140x cheaper than manual analysis. In a 44-run cyber-range, adding the digest lifts success from 20.0% to 42.9%, cuts cost-per-success by 2.7x, and reduces behavioral variance by 5.2x. In Attack-and-Defense exercises, a shared digest produces the Purple agent, winning roughly 2:1 over the LLM-only baseline and 3.7:1 over independently guided teams. This closed-loop guidance is what produces the breakthrough: it reduces ambiguity, collapses the LLM's search space, suppresses hallucinations, and keeps the model anchored to the most relevant parts of the problem, yielding large gains in success rate, consistency, and reliability.
翻译:人工智能驱动的渗透测试目前每小时可执行数千次操作,但仍缺乏人类在竞争性安全环境中运用的战略直觉。为构建网络安全超级智能——即超越人类最佳能力的网络安全人工智能——必须将此类战略直觉嵌入智能体推理过程。我们提出生成式剪绳算法,这是一种博弈论引导层,能够从智能体上下文中提取攻击图,通过工作量感知评分计算纳什均衡,并将精炼摘要反馈至大语言模型循环中,从而引导智能体的行动。在五项真实场景演练中,G-CTR在保持专家攻击图结构70-90%匹配度的同时,运行速度比人工分析快60-245倍,成本降低140倍以上。在44轮网络靶场测试中,引入摘要使成功率从20.0%提升至42.9%,单次成功成本降低2.7倍,行为方差减少5.2倍。在攻防对抗演练中,共享摘要催生的紫色智能体,以约2:1的优势战胜纯大语言模型基线,以3.7:1的优势战胜独立引导的团队。这种闭环引导机制实现了关键突破:它有效降低决策模糊性,压缩大语言模型的搜索空间,抑制幻觉生成,并将模型锚定在问题最相关的部分,从而在成功率、一致性和可靠性方面取得显著提升。