Google’s Agent-to-Agent (A2A) protocol transforms multi-agent collaboration from a closed pipeline into an open and dynamic ecosystem. A2A-based multi-agent systems typically depend on a central orchestrator to coordinate task allocation across agents. However, this paradigm exposes a new attack surface at the agent-orchestration layer: an agent provider can forge an adversarial agent profile to bias the orchestrator’s decisions. We find this risk and propose OrcaJack, an agent orchestration hijacking attack. By injecting a deceptively appealing agent profile into the agent pool, OrcaJack causes user queries in a target domain to be consistently routed to the malicious agent. We formulate the adversarial agent profile construction process as a discrete optimization problem and solve it with a domain-skill-driven genetic algorithm. Across multiple domain benchmarks and orchestrator LLMs, Orcajack can reach up to 100% routing rate, while simple pool-side defenses fail to flag the crafted profiles. Our work is the first to expose the over-trust of agent-declared capabilities in modern agent discovery, motivating pool-side validation defenses.

Automatic exploit generation (AEG) refers to the automatic discovery and exploitation of vulnerabilities against unknown targets. Traditional AEG often targets a single type of vulnerability and still relies on templates built from expert experience. To achieve intelligent exploit generation, we establish a comprehensive benchmark using Binary Exploitation (pwn) challenges in Capture the Flag (CTF) competitions and investigate the capabilities of Large Language Models (LLMs) in AEG based on the benchmark. To improve the performance of AEG, we propose PwnGPT, an LLM-based automatic exploit generation framework that automatically solves pwn challenges. The structural design of PwnGPT is divided into three main components: analysis, generation, and verification modules. With the help of a modular approach and structured problem inputs, PwnGPT can solve challenges that LLMs cannot directly solve. We evaluate PwnGPT on our benchmark and analyze the outputs of each module. Experimental results show that our framework is highly autonomous and capable of addressing various challenges. Compared to direct input LLMs, PwnGPT increases the completion rate of exploit on our benchmark from 26.3% to 57.9% with the OpenAI o1-preview model and from 21.1% to 36.8% with the GPT-4o model.