Keynote: Vulnerability Research in the Agentic Age

Keynote: Vulnerability Research in the Agentic Age

Speakers: Yan Shoshitaishvili, Associate Professor, Arizona State University

Conference: Black Hat USA

YouTube: https://www.youtube.com/watch?v=VNYe3Cnk5Pw

Overview

In this thought-provoking Black Hat USA keynote, Dr. Yan Shoshitaishvili, an Associate Professor at Arizona State University and a veteran of the Capture The Flag (CTF) community, delved into the profound impact of the "Agentic Age" on vulnerability research. The talk explored how advanced AI models and autonomous agents are not merely augmenting human capabilities but are fundamentally reshaping the landscape of software security, from discovery to disclosure. Shoshitaishvili, known for his pioneering work on tools like Angr, presented a compelling vision of a future where vulnerability discovery scales at an unprecedented rate, challenging established norms and demanding new approaches to defense.

The core premise of the keynote revolved around the transition from traditional, human-centric or early-automation vulnerability hunting to an era where sophisticated AI agents can independently analyze, identify, and even exploit flaws. This shift, while promising unparalleled efficiency in bug finding, introduces significant complexities, particularly concerning the responsible disclosure process and the fundamental understanding of vulnerability properties. Shoshitaishvili underscored the critical need for security researchers to adapt by focusing on these underlying properties, rather than solely relying on the black-box capabilities of large language models (LLMs).

This discussion is crucial for the cybersecurity community because it addresses the immediate and future challenges posed by rapidly evolving AI technologies. As AI agents become more autonomous and capable, the sheer volume of discovered vulnerabilities threatens to overwhelm current disclosure and patching mechanisms, potentially making the world less secure in the short term. Shoshitaishvili's talk served as both a warning and a call to action, urging collaboration and innovation to harness the power of agentic AI for proactive defense while mitigating its inherent risks.

Background

▶ Watch: AI fundamentally changing vulnerability research (2:40)

The journey into the agentic age of vulnerability research is built upon decades of evolving techniques, from manual code review to sophisticated automation. As introduced by Black Hat founder Jeff Moss, the origins of modern offensive and defensive security practices can be traced back to the accidental invention of Capture The Flag (CTF) competitions at Defcon over 30 years ago. These early "network fights" quickly revealed a fundamental truth: effective defense requires a deep understanding of attack methodologies. This principle laid the groundwork for the academic and industry pursuit of automated vulnerability discovery.

Dr. Yan Shoshitaishvili's personal trajectory mirrors this evolution. His early experiences as a graduate student, manually performing complex hacking tasks in CTFs, sparked the idea of automation. This led to the creation of Angr, a multimodal symbolic execution framework for binary analysis. Angr, developed by Shoshitaishvili and his CTF team Shellphish, revolutionized vulnerability discovery by enabling reversal and exploitation in ways conventional tools could not. Its open-source nature fostered widespread adoption in over a thousand research projects, academic endeavors, and commercial tools, significantly advancing the state-of-the-art in automated vulnerability analysis.

The field experienced a "fuzzing renaissance" starting around 2013-2015, partly spurred by initiatives like the DARPA Cyber Grand Challenge (CGC), which pushed the boundaries of autonomous vulnerability research. Fuzzers like American Fuzzy Lop (AFL) demonstrated the power of dynamic, stochastic analysis to uncover new bugs even in well-tested code by simply exploring different input paths. However, Shoshitaishvili highlighted a critical challenge: comparing the efficacy of different vulnerability discovery tools (static analyzers, fuzzers, manual review) is incredibly difficult. Each technique, he argued, "cuts out a different shape" of vulnerabilities from the "rolled out dough of vulnerabilities" in a program. A tool might appear "better" simply because it was applied after another, finding bugs the previous tool missed due to its inherent methodology or implicit assumptions about vulnerability properties. This historical context underscores the difficulty in objectively evaluating new techniques, a problem exacerbated by the advent of large language models.

Key Findings

▶ Watch: Accidental invention of Capture The Flag at Defcon (4:30)

Shoshitaishvili outlined three fundamental ways to discover vulnerabilities autonomously, each now hypercharged by agentic AI:

1. Analyze Better: Improve existing analysis techniques to be more precise, faster, and have fewer false positives. This involves developing more capable models that can identify subtle flaws missed by previous generations.
2. Analyze More Things: Scale up the analysis to cover a wider range of software or a larger codebase. Instead of analyzing eight programs, analyze 800, leveraging the sheer volume to uncover more bugs. Tools like Arbiter, built on Angr, exemplify this approach by analyzing entire repositories for vulnerabilities.
3. Analyze Things Differently: Tweak the analysis methodology itself to uncover new classes of vulnerabilities. This often means focusing on different "vulnerability properties" that previous analyses did not explicitly target.

The central key finding of the talk is the paramount importance of vulnerability properties. Shoshitaishvili posited that every analysis, whether explicit (like static analysis) or implicit (like LLM-based approaches or fuzzing), targets specific properties of vulnerabilities (e.g., data flow, injection of attack or control content, multi-threaded behavior). Understanding and explicitly extracting these properties is crucial for maximizing impact in the agentic age.

His team demonstrated this concept through two significant research efforts:

• Huawei's Open Harmony OS Analysis: By mining a decade of Android vulnerability research (agentically assisted) to extract a "recipe book" of vulnerability properties, Shoshitaishvili's team applied these properties to Open Harmony OS, a complete reimplementation of an Android-inspired operating system used by a billion devices. This property-guided manual analysis led to the discovery of dozens of zero-day vulnerabilities, ranging from Bluetooth device takeovers to privacy leaks, demonstrating the power of understanding vulnerability properties to bootstrap security research in new, massive codebases.

• Linux Kernel Local Privilege Escalation (LPE) Research: The team conducted a comprehensive study comparing their agentic pipeline against next-generation models like Mythos. Initially, a "box of dozens and dozens of GPTs" (GPT-3.5/4) produced around 300 LPE vulnerabilities in the Linux kernel, falling short of Mythos's reported 479 bugs. However, by integrating sophisticated workflows and, crucially, applying vulnerability properties extracted from historical bugs and their own findings, their pipeline achieved "all hell broke loose" results. They are now sitting on well over a thousand local privilege escalation vulnerabilities in the Linux kernel, finding them at approximately 10 times the rate they can responsibly report.

This unprecedented scale of vulnerability discovery leads to another critical finding: the current responsible disclosure model is fundamentally broken in the agentic age. Shoshitaishvili cited their prior research in embedded devices, which showed that disclosing a vulnerability, depending on the counting methodology, could endanger three times as many devices as it secures due to slow patching cycles and widespread vulnerable device populations. The exponential increase in discovered bugs only exacerbates this problem, demanding a completely new approach to proactive defense.

Finally, the talk highlighted that even rewriting code in "safer" languages like Rust does not inherently eliminate all vulnerability classes. While Rust mitigates memory corruption vulnerabilities, Shoshitaishvili's experiments with agent-driven Rust rewrites of critical C libraries (e.g., LibSSL, LibPNG, LibXML) and observations of real-world projects (e.g., Rust rewrite of coreutils, which saw 79 CVEs post-release) showed that vulnerability properties related to logic errors, time-of-check-time-of-use (TOCTOU) issues, and classic crypto attacks persist. This demonstrates that the underlying "genetic predisposition" of certain code patterns to specific vulnerabilities transcends language boundaries.

Technical Deep Dive

▶ Watch: Yan's origin, building 'Angr' and CTF dominance (7:00)

The technical core of Shoshitaishvili's keynote lies in the evolution from traditional static and dynamic analysis to agentic pipelines that leverage vulnerability properties for hyper-efficient bug discovery.

Historically, tools like Angr have been foundational for static analysis of binary software. Angr, developed by Shoshitaishvili, is a multimodal symbolic execution framework that can analyze compiled binaries without source code. It allows researchers to explore program paths, identify reachable states, and detect conditions that lead to vulnerabilities. The early success of Angr demonstrated how advanced program analysis could automate tasks previously requiring immense human effort. Building on this, tools like Arbiter were developed, extending Angr's capabilities to analyze binaries at an unprecedented scale, capable of scanning entire software repositories for vulnerabilities. This approach focuses on analyzing more things by making analysis more resilient and scalable.

The "fuzzing renaissance" introduced dynamic analysis techniques, primarily through fuzzers like American Fuzzy Lop (AFL). Fuzzing is a stochastic process where random or mutated inputs are fed into a program to trigger crashes or unexpected behavior, indicating potential vulnerabilities. While highly effective, fuzzers are inherently probabilistic and often find different types of bugs than static analyzers. This illustrates the concept of analyzing things differently, where a change in methodology uncovers a new "shape" of vulnerabilities.

The advent of Large Language Models (LLMs) like GPT and advanced models like Mythos marked a significant shift. Initially, the approach was often a naive "paste code into ChatGPT and ask for bugs," leading to "slop" and hallucinations. Shoshitaishvili's work, however, moves beyond this to the Agentic Age, where LLMs are integrated into sophisticated, autonomous agentic pipelines. The distinction is crucial: agents can work a computer, experiment, evaluate, and ground their failures, avoiding the rampant hallucinations of unguided LLMs.

The technical innovation presented by Shoshitaishvili's team centers on the explicit use of vulnerability properties. Instead of just asking an LLM to "find bugs," their agentic pipeline is informed by a structured understanding of what makes a bug a bug. These properties can include:

• Data flow anomalies: Incorrect data propagation, untrusted input used in sensitive operations.
• Injection vulnerabilities: Command injection, SQL injection, cross-site scripting (XSS) where attacker-controlled data alters program logic or data.
• Multi-threaded behavior issues: Race conditions, deadlocks, or other concurrency bugs.
• Cryptographic weaknesses: Use of weak algorithms, improper key management, side-channel leaks.
• Memory safety issues: Buffer overflows, use-after-free, double-free (though mitigated in Rust, other logic errors persist).

In their Open Harmony OS research, the team employed an agentically assisted mining component to extract these properties from over a decade of Android vulnerability research. This process created a "recipe book" of common vulnerability patterns. This recipe book then guided a highly efficient, human-led (but property-aware) analysis of the millions of lines of code in Open Harmony. This approach of analyzing better and analyzing differently by focusing on known vulnerability properties allowed them to rapidly identify dozens of zero-day vulnerabilities in a massive, relatively new codebase.

The Linux kernel LPE research further refined this agentic approach. Their initial attempts with "dozens and dozens of GPTs" (likely GPT-3.5 and early GPT-4 iterations) yielded 300 LPEs. The breakthrough came with the integration of clever workflows (adversarial reviews, planning, self-correction) and the explicit application of vulnerability properties. By feeding the agents specific patterns and characteristics of historical and newly discovered LPEs, the pipeline could identify and triage over a thousand new LPEs. This demonstrates the power of combining advanced LLMs with structured domain knowledge to achieve unprecedented scale and accuracy. The agents were trained not just to find any bug, but specifically LPEs triggerable by unprivileged users, highlighting the importance of threat model awareness.

The challenge of Rust rewrites also delves into vulnerability properties. While Rust's type system and borrow checker prevent many memory corruption issues, Shoshitaishvili's experiments showed that agents, even with explicit admonitions, would still introduce other types of vulnerabilities. For example, in a Rust rewrite of a cryptographic library, agents might avoid memory corruption but reintroduce classic crypto attacks. Similarly, the 79 CVEs found in the Rust rewrite of coreutils were not memory safety issues but rather time-of-check-time-of-use (TOCTOU) bugs and other logic errors. This highlights that vulnerability properties are deeply rooted in the logic and design of software, not just its implementation language, and require explicit attention in any rewrite or generation process.

The vision for the future is an autonomous sharpening pipeline where agents continually improve their ability to find bugs, evaluate results, and even fix their own research prototypes by grounding failures from new samples. This self-improving system, guided by human understanding of vulnerability properties and data sets, represents the pinnacle of agentic vulnerability research.

Demo / Proof of Concept

▶ Watch: Keynote speaker Yan Shoshitaishvili introduced (8:40)

While Dr. Shoshitaishvili's keynote did not feature a live, interactive demonstration, the entire talk served as a comprehensive exposition of several advanced proof-of-concept systems and their remarkable results. The core "demo" was the presentation of empirical findings from his research lab's agentic pipelines.

Specifically, the talk detailed the successful application of their vulnerability property extraction and application methodology to real-world, massive codebases. For Huawei's Open Harmony OS, the proof of concept involved an agentically assisted process of mining Android vulnerabilities to create a "recipe book" of properties. This recipe book then guided human analysts to uncover dozens of zero-day vulnerabilities in Open Harmony, including issues leading to Bluetooth device takeovers and privacy leaks. This demonstrated the efficacy of a property-guided approach in bootstrapping security research for new, large-scale operating systems.

The most striking proof of concept was the development and application of their agentic pipeline for finding local privilege escalation (LPE) vulnerabilities in the Linux kernel. This system, evolving from using raw GPT access to incorporating sophisticated workflows and explicit vulnerability properties, was able to identify well over a thousand LPE vulnerabilities. The speaker emphasized that these were triaged as "real vulnerabilities" and were triggerable by unprivileged users on a Linux machine. This served as a powerful testament to the agentic age's capability to scale vulnerability discovery by orders of magnitude beyond previous methods, even outperforming reported results from advanced models like Mythos.

Furthermore, Shoshitaishvili described a proof of concept involving agent-driven Rust rewrites of critical C libraries such as LibSSL, LibPNG, and LibXML. While these rewrites successfully produced functional Rust code, they inadvertently demonstrated that even with explicit instructions to avoid past vulnerabilities, the agents would reintroduce different classes of flaws (e.g., classic crypto attacks, logic errors), proving that vulnerability properties are deeply embedded and transcend language choices. These examples, though not live demonstrations, served as robust evidence of the capabilities and challenges inherent in the agentic age of vulnerability research.

Defensive Implications

▶ Watch: Vulnerability research in the agentic age (9:00)

The rise of agentic AI in vulnerability research presents a double-edged sword for defenders. While it offers unprecedented capabilities for discovering and understanding flaws, it also introduces significant challenges to existing defensive paradigms, particularly responsible disclosure and patching.

The most immediate implication is the overwhelming volume of vulnerabilities being discovered. Shoshitaishvili's team finding over a thousand local privilege escalation vulnerabilities in the Linux kernel at 10 times the rate they can responsibly report them highlights a critical bottleneck. The traditional disclosure process, which involves detailed analysis, proposed fixes, and coordination with vendors, cannot scale to this new reality. This leads to a dangerous dilemma: holding onto bugs to ensure quality disclosure means sitting on potentially exploitable flaws for extended periods, while rapid, unfiltered disclosure risks flooding maintainers with "slop" and making systems less safe by empowering attackers with information before patches are available. Their prior research on embedded devices, showing that disclosing a vulnerability can endanger three times as many devices as it secures, underscores the urgency of this problem.

Defenders need to pivot towards proactive defense measures. This might involve exploring new models for vulnerability sharing and remediation that go beyond current responsible disclosure frameworks. Shoshitaishvili suggested ideas like providing candidate "vibecoded" patches that can be applied quickly until official, hardened patches are released. This hints at a future where AI agents might not only find bugs but also generate preliminary fixes, accelerating the patching cycle. Collaboration between researchers, vendors, and the broader security community is essential to adapt to this new scale. The speaker's "too many bugs.wtf" website is an attempt to open this conversation and explore novel solutions for managing a deluge of high-quality bug reports.

Crucially, Shoshitaishvili strongly argued against restricting access to capable AI models. His experience with open-sourcing tools like Angr and his participation in the DARPA Cyber Grand Challenge taught him that the benefits of open technology, particularly for "the good guys" (defenders), outweigh the risks. Restricting access would disproportionately hinder defenders' ability to leverage these powerful tools for their own protection, while sophisticated attackers would likely find ways around such limitations. Therefore, the defensive strategy must focus on empowering defenders with agentic capabilities, rather than attempting to contain the technology itself.

Finally, the talk emphasized the enduring importance of human learning and ingenuity in the agentic age. While agents can automate 90% of the grunt work, the remaining 10% – understanding threat models, extracting and applying vulnerability properties, and guiding the agents to avoid hallucinations and refine their search – still requires human expertise. Cybersecurity professionals must continue to deepen their understanding of fundamental security principles, as this human insight is what allows agents to become truly effective and not just generate noise. The agentic age, therefore, is not about replacing humans but about augmenting them, allowing them to have a much greater impact by scaling their intellectual contributions. Defenders must invest in continuous education and research to remain at the forefront of this evolving threat landscape.

Key Takeaways

• Vulnerability Properties are Key: The efficacy of vulnerability discovery, especially with AI agents, hinges on understanding and explicitly leveraging underlying vulnerability properties (e.g., data flow, injection, multi-threaded behavior) rather than just broad bug hunting.
• Agentic AI Scales Discovery Exponentially: Sophisticated agentic pipelines, guided by vulnerability properties and intelligent workflows, can find vulnerabilities (e.g., over 1000 LPEs in Linux kernel) at rates orders of magnitude faster (10x) than traditional or even early LLM-based methods.
• Responsible Disclosure is Broken at Scale: The current model for responsible vulnerability disclosure cannot cope with the sheer volume of bugs discovered by agentic AI, necessitating new, proactive defensive strategies and collaborative solutions.
• Language Safety is Not a Panacea: Rewriting code in "safer" languages like Rust mitigates memory corruption but does not eliminate other vulnerability classes (e.g., logic errors, TOCTOU, classic crypto attacks), as underlying vulnerability properties can persist.
• Human Expertise Remains Critical: While agents automate much of the work, human understanding of threat models, vulnerability properties, and the ability to guide and evaluate agentic output are indispensable for effective and responsible security research.
• Open AI Models Benefit Defenders: Restricting access to powerful AI models is counterproductive; empowering defenders with these technologies is essential for maintaining a competitive edge against adversaries.

About the Speaker(s)

Yan Shoshitaishvili is an Associate Professor at Arizona State University, where his primary focus is on research into vulnerability analysis, exploitation, and repair, as well as educating the next generation of cybersecurity professionals. He is a prominent figure in the Capture The Flag (CTF) community, having co-created Angr, a pioneering multimodal symbolic execution framework that has significantly advanced automated vulnerability research. Angr's open-source nature led to its widespread adoption in academic, research, and product development contexts. Shoshitaishvili's team, Shellphish, also organized and ran the Defcon CTF, known as Order of the Overflow. His work at ASU, particularly within the SECOM lab and the Center for Cyber Security and Trusted Foundations (CTF Center), continues to push the boundaries of vulnerability research, now with a strong emphasis on leveraging agentic AI. He also runs Pawn College, an open cybersecurity education platform.