Ganni Galea Curmi, Ben Wilde · 2026 · arXiv
DOI: 10.48550/arXiv.2610.28802 · open-access PDF
Seberapa besar pengaruh penggunaan agen terhadap penemuan kerentanan, dan apakah nilainya tergantung pada model? Kami mempelajari 24 konfigurasi model-runner menggunakan perangkat lunak sumber terbuka pada basis kode produksi yang kerentanan tidak publik pada saat pemindaian. Pipa ini menggabungkan pemindaian statis, investigasi LLM, pengvalidasi diri model, pemetaan akar penyebab, ulasan sumber independen, dan konfirmasi bukti konsep terisolasi. Di atas 265 penyebab akar keamanan yang dikonfirmasi, konfigurasi dua run terbesar mencakup 60.4%, sementara 14,3% ditemukan oleh satu model.
Machine translation (Meta M2M100); the English original follows.
How much does an agent harness affect vulnerability discovery, and does its value depend on the model? We study 24 model-runner configurations using an open-source harness on a production codebase whose vulnerabilities were non-public at scan time. The pipeline combines static screening, LLM investigation, model self-revalidation, root-cause mapping, independent source review, and isolated proof-of-concept confirmation. Across 265 confirmed security root causes, the largest two-run configuration covers 60.4%, while 14.3% are found by exactly one model. No single configuration covers all observ
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.28802, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange