AgentHammer: Triggering Simulated Rowhammer Bit-Flips via LLM Agents with Hardware-Aware Simulation-in-the-Loop Skills

As modern DRAM manufacturing processes continue to shrink, the Rowhammer vulnerability has emerged as one of the most severe threats to microarchitectural security isolation. To defend against such attacks, hardware vendors have introduced complex black-box defense mechanisms in memory controllers, such as FR-FCFS (First-Ready First-Come–First-Serve) queue coalescing, Target Row Refresh (TRR), and the open row policy. These defenses provide the context for this work; in the evaluation reported here, we explicitly model the FR-FCFS scheduling family and the open row policy, while realistic TRR is not modeled and is left for future work. These mechanisms have rendered traditional vulnerability exploitation approaches, which rely on security experts manually crafting inline assembly, increasingly unsustainable. In recent years, large language models (LLMs) have become strong at software code generation. However, when applied to low-level hardware vulnerability exploitation, they encounter a severe “semantic–physical gap.” Conventional LLMs lack embodied cognition of physical hardware state machines; their generated memory access loops often compile and run correctly at the software layer, but the majority of requests are absorbed by caches and microarchitectural queues before reaching physical memory, trapping the LLM in a “false-positive state” where simulated ACT counts remain near zero. Most existing research treats LLMs as victims of Rowhammer attacks, overlooking their potential as active attack initiators at the hardware level. To address these challenges, this paper repurposes LLMs as microarchitectural attackers for the first time and designs AgentHammer—a closed-loop agent framework that allows LLMs to conduct automated hardware vulnerability exploitation. To bridge the software–hardware semantic gap, we construct a Hardware-Aware Simulation-in-the-Loop (HASIL) perception skill chain that deeply couples the QEMU full-system simulator with the Ramulator memory simulator. This chain captures low-level timing measurements—such as simulated ACT counts and simulated row conflict rates—transparently and reduces their dimensionality into natural language feedback comprehensible to LLMs. At the same time, we distill rigid low-level constraints—such as cache eviction and access stride—into reasoning primitives for the model, establishing a closed-loop verification pipeline of “perception, decision, feedback, and evolution,” in which the LLM adapts its parameters within the constraints set by human experts. Experimental results show that AgentHammer effectively breaks through the false-positive blind zone of pure software code generation. In complex microarchitectural simulation environments, the system autonomously reasons over low-level feedback logs and mutates parameters, successfully discovering, within our simulated configurations, the optimal access pattern that overcomes the FR-FCFS request-queue optimization and the open-row policy, ultimately achieving simulated row conflict. This work not only shows that large foundation models can explore physical boundaries in black-box environments through autonomous parameter adaptation, but also provides a basis for highly automated low-level hardware security assessment.