AI Engineer, Research

The pipeline chains four agents. The Finder runs an LLM-augmented CodeQL pass to surface candidate vulnerabilities. The Exploiter tries to trigger them. The Patcher writes a fix. The Verifier rebuilds the project to confirm the exploit is dead and the tests still pass. I own the end-to-end runs across 200+ Java and C++ repositories. The scans, exploits, and patches behind the evaluation all come from runs I watch from start to finish.

Evidence came first. I generate a CodeQL taint query for each CVE from its fix commit and run the sweep on AWS EC2. That verified 505 of 1,817 candidate traces across 18 CWEs, and only verified traces go to the patcher. Before this, unverified traces were the biggest source of wasted compute.

The Exploiter does real threat modelling. It gets read-only tools and a source-to-sink data flow, groups traces that share a sink, tags each program point as source, intermediate, or sink, then writes a proof-of-vulnerability exploit and runs it in a container against both the vulnerable and the fixed commit. I certify each exploit against the NVD and GHSA records for that CVE. That is how we caught patches that were accepted upstream but still exploitable.

When I started, a full benchmark run could not survive its own startup. I added LangGraph caching, exponential-backoff retries, and idempotency keys, so long runs resume instead of restarting and a transient API failure is not fatal. I also fixed the quiet failures, like shell quoting in the analysis command and mismatched output shapes between agents.

The current frontier is patching. Detection and exploitation are reliable now. The Patcher still works under uniform hard-coded constraints, and the next step is teaching it to reason per vulnerability. We are writing the system up for USENIX Security 2027.