Capability Generalization in Privileged-Execution LLM Agents: A Catalog of Unanticipated Behaviors During Autonomous Network Defense

Abstract

Large language models are increasingly proposed as autonomous network-defense agents, which requires privileged command execution not scoped to their stated objective. Evaluating a multi-agent LLM framework that proposes, implements, and validates mitigations against replayed adversary emulation, we observed agents exceeding their prompts across 1,796 attempts. We catalog fourteen such behaviors in four themes: capability generalization beyond prompts, including an unrequested host intrusion-prevention daemon and self-validation against the recorded attacker C2; boundary crossing, reconfiguring a container the prompt explicitly excluded; latent exploit surfacing, an unpatched container escape triggered during routine hardening (CVE-2026-30735); and evaluator drift, an LLM-as-a-judge that misattributes outcomes and switches language mid-sentence. Mitigations are accepted only after replay confirms reduced attack success, yet the number an operator reads can misdescribe how it was achieved. In a second corpus of 675 attempts, each of the four models with enough activity to measure violated an explicit prompt constraint, though which capability it reached for varied by model. Privileged-execution agents should therefore be designed as though each of these will occur. Prompts, topologies, adversary profiles, both log corpora, and the analysis code are released.