Mako: A Self-Evolving Agentic Operating System (SE-AOS) for Autonomous Web Exploitation

Jul 16, 2026

The Self-Evolving Agentic Operating System (SE-AOS), introduced as a new AI agent class, models exploit capability as a mutable, versioned kernel that extends at runtime. SE-AOS observes its own failures, synthesizes new capabilities, proves them against live targets, and hot-loads validated improvements back into itself. Mako is the LaunchSafe engine enabling continuous offensive testing and agent-driven security research, achieving verified full-suite coverage on XBOW.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages13

Reading Time33 min

Introduction

Positioning and Novelty

System Overview

Methodology

Self-Evolution and Capability Kernel

Fabrication-Proof Verification

Results and Evaluation

XBOW-104 Coverage

Verification Procedure

Disclosure and Dual-Use Considerations

Mako: A Self-Evolving Agentic Operating System (SE-AOS) for Autonomous Web Exploitation Praneeth Narisetty LaunchSafe [praneeth@launchsafe.com](praneeth@launchsafe.com) Shiva Nagendra Babu Kore LaunchSafe [shiva@launchsafe.com](shiva@launchsafe.com) arXiv :2607 . 1 1288v 1 [ cs .CR] 13 Jul 2026 Abstract—We introduce the Self-Evolving Agentic Operating System (SE-AOS): a new class of AI agent that treats exploit capability as a mutable, versioned kernel it extends at runtime, observing its own failures, synthesising new capabilities, proving them against a live target, and hot-loading them back into itself. Mako is the first SE-AOS instance for security research and the autonomous web exploitation engine developed within LaunchSafe. LaunchSafe builds autonomous security agents for continuous offensive testing and agent-driven security research; Mako is the core engine behind that platform. On the public XBOW validation-benchmarks, 104 containerised, CTFstyle web applications spanning 26 vulnerability classes across three difficulty tiers, Mako achieves full-suite coverage: it drives every one of the 104 targets to emit a cryptographically fresh, per-build flag, under a verification regime that makes fabricated or memorised results impossible. Our central result is a law of autonomous exploitation: once a capability exists and is discoverable, difficulty collapses; capability, not reasoning, is what is scarce, together with an architecture and formalism that turn that law into a self-improving system. Mako further runs agated self-evolution loop that proposes, sandboxes, and commits improvements to its own agents and rules when fitness does not regress. We deliberately withhold the operational results, payloads, exploit chains, and tool source, because a system that reduces full-spectrum web exploitation to a repeatable, machine-speed pipeline is dual-use research of concern. We publish the science; we withhold the weapon. Index Terms—autonomous exploitation, AI agents, agentic operating system, capability kernel, LLM agents, offensive security, penetration testing, XBOW, web application security, fabrication-proof evaluation, dual-use research, self-improving agents, LaunchSafe, Mako I. INTRODUCTION A. Positioning and Novelty This is a systems, theory, and methodology paper, not aleaderboard entry. Its contribution is not a single number but (i) a new class of agent architecture, (ii) a formalism that makes self-evolution measurable, and (iii) a complete, auditable pipeline that turns difficult web-exploitation problems into verified exploit capability, without ever admitting a fabricated flag, a memorised string, or an unverifiable self-report. To our knowledge, no prior published system combines a selfauthored, runtime-growing capability kernel with a fabricationproof verification gate and full-suite coverage of a security benchmark. Mako advances the state of the art on five axes: (1) a new architectural class, the Self-Evolving Agentic Operating System, in which capability is a mutable, versioned kernel TABLE I AT A GLANCE | System | Mako SecurityResearchAgent (LaunchSafe), a self-evolving, tool-authoring security-research agent | | --- | --- | | Reasoning models | Primary: Google Gemini 2.5 Flash; escalation tier: Gemini 3.1 Pro Preview (engages only after the agent passes 70% of the turn budget with no confirmed finding) . Both are Gemini-family models [16](no separate technical report exists for these specific preview versions); per-turn model was not separately logged, so the escalation model’s exact per-benchmark use is unconfirmed. | | Benchmark suite | XBOW validation-benchmarks [15], 104 Jeopardy-style web CTFs (XBEN-001-24. . . XBEN-104-24); 26 vulnerability classes across three difficulty tiers | | Headline result | Full-suite coverage, 104/104 benchmarks driven to emit a freshly-randomised flag from the live target; every solve verified against the genuine application response, never

FAQs

What is SE-AOS and how does it improve exploit capability over time?

SE-AOS treats exploit capability as a mutable, versioned kernel extended at runtime. It observes failures, synthesizes new capabilities, proves them against live targets, and hot-loads validated improvements back into itself.

How does Mako prevent fabricated or memorized evaluation results?

Mako uses fresh randomized per-build flags and verification against ground-truth application responses captured in real tool outputs, rather than relying on agent self-reports.

What evaluation result does Mako achieve on the XBOW-104 benchmarks?

On the public XBOW validation benchmarks, Mako achieves full-suite coverage with 104 out of 104 containerized web CTF targets, spanning 26 vulnerability classes across three difficulty tiers.

Jul 16, 2026

Upload by Evangeline