No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt

What it is

An experience paper from Arizona State University: Bajaj, Mei, Bao, Shoshitaishvili, Wang and Doupé. It describes a five-phase agentic workflow for vulnerability discovery. The most concrete evidence is the Linux kernel result: around 200 unique crashes found with LLM-assisted methods, more than 20 of them assigned CVEs, and the rest still being disclosed. One of these, CVE-2026-31419, was found, exploited and patched by the authors and won a $10,000 kernelCTF bounty.

How it works

The workflow has five phases: reconnaissance, vulnerability scoping, hypothesis creation, hypothesis verification, and downstream use (reporting, root-causing, patching, chaining). Hypotheses can come from the agent alone or from fuzzer and taint-engine output. Verification runs generated inputs or scripts against the target, or uses a second agent. Failed candidates are discarded or refined and revalidated. The authors say structured multi-step use beats one-shot prompting. They also say scoped analysis plus dynamic verification cuts false positives, and that better reverse-engineering tools and program representations improve agent results.

flowchart LR
  A[Recon] --> B[Scoping]
  B --> C[Hypothesis]
  C --> D{Verify}
  D -- pass --> E[Report / patch / chain]
  D -- fail --> F[Refine or discard]
  F --> C

CVE-2026-31419 (Linux bonding, bond_xmit_broadcast()):

• The function iterates over an RCU snapshot of the slave array. It calls bond_is_last_slave(), which reads the live linked-list tail, to decide whether to reuse the original skb or clone it.
• If a slave is enslaved or released mid-loop, the tail moves. With slaves [A, B], the thread consumes the skb at B, another thread enslaves C, and the TX thread reaches C. C also passes the "last" check, so the freed skb is reused. The result is a double free / use-after-free.
• The fix is one line in drivers/net/bonding/bond_main.c: replace bond_is_last_slave(bond, slave) with i + 1 == slaves_count, using a count snapshotted before the loop.
• The bug lived from January 2022 to March 2026 despite continuous syzkaller fuzzing. The authors attribute this to the race producing no coverage signal until it fires.
• The agent linked related data-path and config-path functions and steered syzkaller toward them using its focus-area feature. It then triaged the crash, hypothesized the race, and wrote a PoC. That took several hours, with many failed attempts and no manual effort.

Preconditions / Affected

For CVE-2026-31419, the affected code is the bonding driver's broadcast transmit path. Triggering it needs concurrent transmit and enslave/release operations. The page gives no affected version range beyond the January 2022 to March 2026 window.

What to do

• If you run Linux with bonding in broadcast mode, check that the one-line fix [33] is in your kernel.
• If you fuzz kernels, consider agent-directed focus areas that pair data-path and configuration-path functions. The paper presents this as the step that surfaced the race.
• Pair agent-generated hypotheses with dynamic verification before triage.

Caveats

• Exploitation was not autonomous. The double free trips the kernel's hardening check. The agent spent two days failing to get around it, and a human expert connected a netem scheduler to delay the second free.
• The agent also picked mismatched reclaim primitives (msg_msg, pipe_buffer) until it was told the allocator state and directed to use sk_buff allocation. The authors conclude that human expertise remains necessary at critical steps on a hardened kernel (KASLR, SMEP/SMAP, SLAB hardening).
• The authors contrast this with a reported autonomous FreeBSD exploit, which they say needs little beyond a memory corruption primitive.
• The paper says it does not investigate or automate exploit generation, yet this CVE's exploitation was agent-assisted with human guidance.
• Other targets (XNU, firmware, web applications, Windows drivers) are covered, but the fetched text cuts off there, so no per-target results are available beyond a model/technique table. That table lists GPT-5.4 and Claude Opus 4.6 for several targets.