Gap-Targeted LLM Test Generation for IoT Security: Discovering Novel Vulnerabilities Beyond AutoML-Prioritized Registries

IoT security test suites are typically drawn from static registries, which caps the attack surface that automated prioritization can explore. We propose a gap-targeted hybrid pipeline that couples AutoML-based test prioritization with LLM-generated tests conditioned on coverage gaps detected in execution history. Across 15 experimental cells (5 frameworks x 3 modes) on 13 Dockerized IoT devices spanning seven protocols, LLM-authored tests discovered 17 exclusive scenarios, that is, attack paths never exercised by the registry, spanning six vulnerability categories mapped to the Common Weakness Enumeration (CWE). The hybrid approach complements, rather than replaces, existing security tooling.