AI Agents for Vulnerability Discovery

The Problem

Almost all deployed vulnerability detection needs somebody to write down what the bug looks like before it can find one. A sanitizer, a static checker, a lint rule, a fuzzing harness — each encodes a specification that a person authored. That limits detection to the classes people have already thought of, and it makes every new class an authoring project.

AI agents change what is affordable here, not what is true. An agent can read code the way a reviewer does, follow a data flow across files, and form a hypothesis without anyone having written a rule for it — but it can also be confidently wrong at a scale no reviewer could match, and a finding without evidence costs a maintainer the same attention whether or not it is real. The useful question is not whether an LLM can flag a bug. It is what makes a machine-generated security claim worth a human's time.

The Approach: Recover the Specification, Then Make It Executable

Qiushi Wu's work builds methods that recover a program's own expectations rather than importing hand-written ones — from how the code behaves, from what comparable code does, and above all from what a fix changed. Three commitments run through it:

• Patch-derived detection rules. A fixing commit is the most precise available statement of why some code was unsafe. Turning it into a rule that runs elsewhere converts a one-time repair into reusable detection.
• Validated vulnerability discovery. A finding should arrive with evidence a maintainer can check — an execution, a provenance link, a differential test — rather than a confidence score.
• Cheap analysis before expensive models. Parsing and heuristics answer the questions they can answer. Agents are spent on what survives, which is what makes the approach affordable at the scale of a distribution rather than a single file.

Systems

BugStone-E2E — agentic vulnerability discovery from CVE patch history (arXiv 2026)

Turns the patch history behind disclosed CVEs into executable detection rules, then runs a funnel — Tree-sitter anchors, LLM-free heuristics, LLM agents, runtime verification, scope-checked patches — over the candidates they identify. 1,033 rules across 56 CWE families, mined from 2,710 fixing commits behind 19,325 high-severity CVEs, producing runtime evidence for 644 findings across 14 programs. This is the current version of the line described in the next two entries. Project page · arXiv:2609.05335

BugStone — LLMs for large-scale bug discovery (ICML 2026)

Established the core claim: a fixed bug describes a mistake other code is still making, and that mistake can be captured as a rule an LLM can apply elsewhere. 135 rules flagged 22,568 candidate sites in the Linux kernel; 246 of 400 sampled at random were confirmed by hand, and the rules reached 92.2% precision on a separate 850-patch benchmark. Published at the International Conference on Machine Learning. Paper · arXiv:2510.14036 · BugStoneBench

“Detecting bugs using large language models” — the method, filed July 2024

The mechanism behind both systems, filed as a U.S. patent application on 15 July 2024, a year before agentic vulnerability discovery became a crowded field: analyze a patch with a large language model to identify the security rules the bug violated, extract the code contexts around the fixed segments, locate target code segments elsewhere that those rules reach, and prompt the model per target site. Qiushi Wu, Zhongshu Gu, Enriquillo Valdez, and Hani Talal Jamjoom, assigned to IBM. US 2026/0017174 A1

GNNIC — recovering indirect-call targets (NDSS 2024)

Indirect calls are where most whole-program analysis loses the thread. GNNIC finds a function's long-lost siblings by abstract similarity, recovering call targets that type-based matching misses. Basis of U.S. Patent 11,853,751. Paper

DiffCVSS — OS-aware vulnerability prioritization (USENIX Security 2022)

One vulnerability does not deserve one severity score. The same flaw has different consequences on different operating systems, and differential severity analysis recovers that difference automatically. Paper · Code & data

HERO — disordered error handling (USENIX Security 2021)

Error paths are where cleanup goes wrong, and what should happen on them is never written down. HERO pairs functions to infer the expected ordering and flags the places that break it. Paper

SID — the security impact of a patch (NDSS 2020)

The first step in this line: most security fixes land quietly, so SID compares symbolic rules before and after a patch to decide whether it fixed a security bug and what that bug allowed. Everything later depends on being able to read a fix automatically. Paper

The full publication list, including co-authored work on fuzzing, missing-check detection, memory leaks, and the security of LLM-generated code, is on the homepage.

The Field, as of September 2026

Agentic vulnerability discovery became crowded quickly. The systems in it are easiest to tell apart by asking where each one's knowledge comes from — the model, the target, a known report, or the disclosed history of other software.

These categories are complements, not competitors, and the boundaries are already blurring — several systems patch as well as detect, and the exploratory agents increasingly consult external knowledge. What distinguishes the history-derived approach is that its knowledge is written down and citable: the corpus can be inspected, extended, and disagreed with, and a finding arrives attached to a specific prior vulnerability rather than to a model's judgement.

Descriptions are summarized from each system's own published material and link to it. They are not evaluations, and no cross-system comparison of numbers is implied: these systems do not measure the same quantity, and as of this writing there is no shared benchmark on which they all report.

Open Problems

The ones that seem to matter most, from inside this line of work:

• Evidence standards. Every system reports a different unit — a static warning, a triaged candidate, a reproduced crash, a merged patch. Until these are named consistently, comparing two agentic systems is comparing two definitions.
• The unreported tail. History-derived rules cannot reach a bug class nobody has disclosed. How much of the real defect population that excludes is unmeasured, and probably measurable.
• Maintainer cost. Volume is now cheap on the producing side and still expensive on the receiving side. An agent that files a hundred plausible reports can consume more maintainer attention than it saves — a question of research ethics as much as engineering.
• Agents as the attack surface. The same systems that analyze code are increasingly part of the code, reading untrusted input and holding credentials. That direction is the subject of a proposed course and of ongoing work on red-teaming agent systems.