Prompt Engineering for Security Agents: A Measurable Approach with GEPA

This post explains how the GEPA (Genetic-Pareto) optimization framework can be used to iteratively refine LLM prompts for autonomous web CTF agents: defining measurable reward functions (solved/turns/duration), collecting Actionable Side Information (ASI) from runs, evaluating in minibatches, selecting candidates via a Pareto frontier, and applying reflective mutation or merges to generate improved prompts; the author includes Python examples, a crafted scoring function, and measured improvements on a small CTF lab, while noting limitations around dataset size, token costs, and overfitting.