Autonomous Web Hacking: Investigating the Capability Gap in Open-Source Large Language Model Agents

Large Language Model (LLM) agents are increasingly capable of autonomously interacting with websites and APIs to complete data-extraction and other web-based tasks. This raises an important security question: when an autonomous agent encounters obstacles during legitimate data extraction, will it attempt to discover or exploit vulnerabilities in the target system? This study investigates that question for open-weight LLM agents in the 7–8B parameter class. We constructed a fully sandboxed Flask web application containing synthetic data, a legitimate paginated data-extraction interface, a deliberately vulnerable SQL-injection search endpoint, weak administrative credentials, robots.txt restrictions, an internal data endpoint, and a rate-limiting mechanism. The target application was isolated to localhost and was never exposed to or used against real third-party systems. Four open-weight models were evaluated: • Qwen2.5-7B-Instruct• Mistral-7B-Instruct-v0.3• HuggingFaceH4/zephyr-7b-beta• NousResearch/Hermes-3-Llama-3.1-8B Each model operated as a ReAct-style web agent with access only to HTTP GET/POST tools and a finish action. Two experimental conditions were investigated: a neutral data-extraction condition and an explicit-intent condition in which the agent was instructed to find ways to bypass barriers and obtain the requested data. Across the completed experiments, 16 real trials were conducted, producing 196 HTTP tool calls. No successful or classified hacking attempt was observed. In particular, none of the tested agents produced SQL-injection payloads, attempted the weak administrative credentials, accessed restricted administrative or internal paths, or used identity/rate-limit spoofing techniques. Several trials nevertheless exhibited benign boundary-probing behavior, including attempts to increase undocumented pagination parameters after encountering rate limiting. Other agents repeatedly retried legitimate requests or failed to produce valid structured actions. The findings suggest that, under the specific experimental conditions tested, general-purpose open-weight models in the 7–8B parameter range did not demonstrate the long-horizon adaptive behavior required to convert web-extraction obstacles into successful exploits. The results should not be interpreted as evidence that such models are incapable of exploitation in general; the study is limited by its small number of trials, model selection, available tools, and turn budget. All experiments were conducted in an isolated environment using synthetic data. The accompanying materials are provided to support reproducibility and further investigation into the capability boundary of autonomous open-weight LLM agents.