一句话：提出一个 630 行 Python 参考框架 Cochise，用于可复现地比较 LLM 自主渗透测试中的模型、智能体架构与轨迹。
LLM 驱动的自主渗透测试已有不少乐观结果，但现有系统往往把架构设计、提示工程与工具集成耦合在一起，难以判断相对简单 agent 与 harness 究竟带来了多少增益。本文提出 Cochise——一个约 630 行 Python 的自主渗透测试参考实现。它通过 SSH 连接 Linux 执行主机，可攻击该跳板机可达的受控目标环境；原型采用 Planner–Executor 架构，由 planner 维护长期状态，ReAct 风格的 executor 通过 SSH 下发命令并根据输出自我纠错，场景提示可按目标环境调整。作者在真实第三方测试平台 Game of Active Directory（GOAD）上评估该框架，并明确指出其定位不是最先进的渗透测试 agent，而是可复用的实验基础设施，用于比较模型、agent 架构与渗透轨迹。配套发布 cochise-replay（离线可视化回放）、cochise-analyze-logs 与 cochise-analyze-graphs（成本、token、时长与攻陷分析）以及 GOAD 运行的 JSON 轨迹日志语料，使研究者无需自备 48–64 GB 内存、190 GB 存储的测试平台即可研究 agent 行为。
Recent work on LLM-driven autonomous penetration testing reports promising results, but existing systems often bundle architectural, prompting, and tool-integration choices together. This makes it difficult to determine what is gained over a simple agent and harness. We present Cochise, a 630 LOC Python reference implementation for autonomous penetration-testing experiments. Cochise connects to a Linux execution host over SSH and supports attacking controlled target environments reachable from that jump host. The prototype implements a Planner--Executor architecture in which long-term state is maintained by the planner, while a ReAct-style executor issues commands over SSH and self-corrects based on command outputs. The scenario prompt can be adapted to different target environments. We evaluate the harness against a live third-party testbed, Game of Active Directory (GOAD). Cochise is intended not as a state-of-the-art penetration-testing agent, but as a reusable experimental infrastructure for comparing models, agent architectures, and penetration-testing traces. Alongside the prototype, we release replay and analysis tools: (i) cochise-replay for offline visualization of captured runs, (ii) cochise-analyze-logs and cochise-analyze-graphs for cost, token, duration, and compromise analysis, and (iii) a corpus of JSON trajectory logs from GOAD runs, so that researchers can study agent behavior without provisioning the 48-64 GB RAM / 190 GB storage testbed themselves. Tool demo video available at https://youtu.be/2mQimB1ufyI.