Reproduce “No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Ati Priya Bajaj, Xiang Mei, Tiffany Bao, Yan Shoshitaishvili, Ruoyu Wang, Adam Doupé
The authors describe agent-supported vulnerability research across operating-system kernels, drivers, firmware, web applications, and reimplemented libraries. Their examples include roughly 200 Linux kernel crashes, more than 20 CVE assignments, and over 200 reports from about 25 web applications, while also showing that tool-based validation and human review remain essential to filter false positives and confirm findings.
Key insights
- Agents are most useful as coordinators of existing analysis methods: they can connect execution paths, develop test inputs and harnesses, interpret crashes, and pursue application-specific behavior.
- A plausible explanation or working local proof of concept is not sufficient on its own; findings can depend on test-only conditions, unreachable paths, inactive firmware code, or misunderstood business logic.
- The work is an applied account, not a controlled comparison, and it highlights persistent needs for human review, reproducible verification, strong decompilation, suitable hardware, and auditable agent behavior.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.