In plain words: They placed language-model agents in a simulated multi-agent cyberattack defense game alongside agents trained by trial and error, giving teams a shared way to communicate. Tests showed each kind has clear strengths and weaknesses, pointing to mixed teams as a promising direction.
Abstract · Large Language Models are Autonomous Cyber Defenders
Fast and effective incident response is essential to prevent adversarial cyberattacks. Autonomous Cyber Defense (ACD) aims to automate incident response through Artificial Intelligence (AI) agents that plan and execute actions. Most ACD approaches focus on single-agent scenarios and leverage Reinforcement Learning (RL). However, ACD RL-trained agents depend on costly training, and their reasoning is not always explainable or transferable. Large Language Models (LLMs) can address these concerns by providing explainable actions in general security contexts. Researchers have explored LLM agents for ACD but have not evaluated them on multi-agent scenarios or interacting with other ACD agents. In this paper, we show the first study on how LLMs perform in multi-agent ACD environments by proposing a new integration to the CybORG CAGE 4 environment. We examine how ACD teams of LLM and RL agents can interact by proposing a novel communication protocol. Our results highlight the strengths and weaknesses of LLMs and RL and help us identify promising research directions to create, train, and deploy future teams of ACD agents.
Sebastián R. Castro, Roberto Campbell, Nancy Lau, Octavio Villalobos, Jiaqi Duan, Alvaro A. Cardenas
arXiv:2505.04843 · cs.AI, cs.CR · submitted May 7, 2025 · updated Jul 19, 2025
abstract · pdf · html · Presented at IEEE CAI Workshop on Adaptive Cyber Defense 2025