Leveraging large language models for vulnerability discovery has become an important paradigm in security research. However, large-scale automated deployment still faces two major obstacles. First, LLM-generated vulnerability reports often suffer from high false-positive rates, creating substantial manual review costs. Second, vulnerability research requires more than report generation: it must integrate discovery, validation, PoC construction, and patch generation. In this talk, we present an end-to-end automated vulnerability research agent system for large codebases.

When using LLMs to audit large codebases, we frequently observe performance degradation as more code is added to the model context, even before the context window is full. Context management is therefore a primary focus of our work. We introduce three context-management mechanisms: reasoning-trace-driven adaptive compression, semantics-aware context separation, and report-directed context construction. With this design, our system identifies substantially more vulnerabilities than Claude Code in our experiments while maintaining a low false-positive rate.

We further extend our system with dynamic validation for Linux kernel vulnerabilities. Using a specially designed harness, the system iteratively debugs candidate vulnerabilities inside a QEMU environment and constructs PoCs capable of triggering KASAN.

For automated patch generation, we use multi-agent collaboration and fine-grained context management to reduce incorrect or incomplete fixes, unintended side effects, and new vulnerabilities introduced by generated patches. By separating patch generation and patch validation into dedicated agents, we establish a review-and-refinement loop that improves patch correctness and completeness.

To date, maintainers have confirmed 90 zero-day vulnerabilities identified by our system across projects including the Linux kernel, VirtualBox, and open-vm-tools. Of these, 62 have been fixed and 51 have been assigned CVE identifiers.