FuzzingBrain V2: LLM-Based Vulnerability Discovery

• FuzzingBrain V2 is a distributed, multi-agent LLM system that automates vulnerability discovery and reproducible crash generation through integrated static and dynamic analyses.
• It introduces a novel Suspicious Points abstraction and hierarchical function scheduling to precisely localize and verify vulnerability candidates.
• Empirical evaluations on AIxCC 2025 benchmarks and OSS-Fuzz projects demonstrate a 90% detection rate and significant zero-day discoveries.

FuzzingBrain V2 is a distributed, multi-agent LLM system for automated vulnerability discovery and reproducible crash generation. Built atop Google’s OSS-Fuzz infrastructure, FuzzingBrain V2 employs a novel control-flow abstraction—Suspicious Points (SP)—and a hierarchical, logic-driven function scheduling pipeline. The system integrates static and dynamic analysis tools via Model Context Protocol (MCP), orchestrating collaborative LLM agents to localize, verify, and exploit vulnerability candidates, achieving 90% detection on the AIxCC 2025 C/C++ benchmark and significant zero-day discoveries across open-source projects. Each discovered vulnerability is guaranteed fuzzer-reproducible, directly addressing prevailing concerns of verification and high false-positive rates in automated LLM-based systems (Sheng et al., 20 May 2026).

1. System Architecture

FuzzingBrain V2’s architecture orchestrates multiple agents, distributed across parallel worker pipelines, with persistent state maintained in MongoDB and task queues via Redis. The top-level control is managed by a Controller and Scheduler, which:

• Initiates a static-analysis phase via Fuzz Introspector, extracting call graphs, function metadata, and fuzzer reachability sets,
• Launches up to $F\times S$ worker processes, each corresponding to a $({\text{fuzzer}}, {\text{sanitizer}})$ pair.

Within each worker, the pipeline operates in three sequenced stages:

1. Static Analysis: Shared, read-only extraction of call graphs and reachability information.
2. Agent Pipeline: A series of MCP-driven LLM agents collaborate to generate, deduplicate, and triage Suspicious Points, reason over call chains, and compress context as needed.
3. PoC Generation & Dual-Layer Fuzzing: LLM-based input generation coupled with both global and SP-focused fuzzing, with reproduction checks under sanitizers.

Agents specialize by tier and role (see Table 1):

Agent Name	Tier	Function
Direction Generator	1	Partitions codebase into logical “directions” (features)
SP Generator	2	Emits SPs at function granularity, consults call/callee on demand
SP Deduplicator	3	Merges semantically equivalent SPs
SP Verifier	1	Performs sanitizer-aware validation and reachability checks
Context Compressor	3	Summarizes deep call contexts for efficient LLM reasoning
PoC Generator	2	Produces Python-style blob generators for SP exploitation
Seed Generator	2	Generates corpus seeds for global fuzzing
Report Agent	2	Formats vulnerabilities into reports/advisories

Failed LLM calls are automatically retried within the same tier using alternative model endpoints.

2. Suspicious Point (SP) Abstraction

FuzzingBrain V2 introduces Suspicious Points (SPs), a formal control-flow-based abstraction positioned between function-level and line-level vulnerability localization. An SP is defined as:

$\mathrm{SP} = \bigl(f,\; P,\; T,\; d,\; s\bigr)$

where

• $f$ is the function name,
• $$P = (v_1 \to \cdots \to v_k) \subseteq \mathrm{CFG}(f)$$ denotes a landmark path in the control-flow graph,
• $T$ specifies the vulnerability type (e.g. heap-buffer-overflow), aligned with the active sanitizer,
• $d$ is a data-flow-centric description from input to sink,
• $s \in [0,1]$ is the LLM-assigned confidence score.

SPs transition through the states: created $\rightarrow$ verified $\rightarrow$ real, with explicit fields for verification, PoC guidance, and reproducibility status.

This abstraction addresses the limitations of earlier approaches, striking a balance between excessive contextual breadth (function-level) and insufficient contextual framing (line-level), while enabling precise reachability and data-flow reasoning, especially in codebases with intricate cross-function dependencies.

3. Hierarchical Function Scheduling and Dual-Layer Fuzzing

Hierarchical function scheduling in FuzzingBrain V2 leverages both static analysis and semantic clustering (via the Direction Generator) to maximize vulnerability coverage. Each function $({\text{fuzzer}}, {\text{sanitizer}})$0 is annotated with its reachability and call depth; functions are assigned to Core or General pools within their direction, with execution priority managed by a global priority queue:

$({\text{fuzzer}}, {\text{sanitizer}})$1

Function-specific SP generation ensures analysis at optimal granularity, aided by on-demand expansion to caller and callee functions. The system alternates between Full-Scan and Delta-Scan modes, adapting to resource constraints and program structure.

Dual-Layer Fuzzing comprises:

• Global Fuzzer: Continuously runs coverage-guided fuzzing (via OSS-Fuzz/libFuzzer) using seeds synthesized from direction harnesses and non-exploitable SPs. Crashes are reported in real time.
• SP Fuzzer: For each verified SP, a dedicated libFuzzer instance is launched. In Verification Mode, up to 40 LLM-generated inputs are tested for crash induction. In Background Mode, unsuccessful blobs expand the corpus, with the fuzzer mutating while the LLM continues further reasoning and generation.

This configuration enhances depth and breadth in search, enabling efficient exploration of hard-to-reach vulnerabilities and edge cases.

4. Static/Dynamic Analysis and Context Engineering

FuzzingBrain V2 integrates static and dynamic analysis utilities through MCP-enabled communication:

• Static Tools: APIs for extracting call graphs, function source, reachable functions, and caller/callee relationships.
• Dynamic Tools: Automated testing of inputs (verify_pov); after 15 failed attempts, trace_pov provides a call trace to inform subsequent LLM reasoning cycles.

Context Engineering uses the Context Compressor to provide hierarchical, semantically-meaningful summaries of deep call chains. When backward slices from an SP’s sink exceed a token threshold $({\text{fuzzer}}, {\text{sanitizer}})$2, the system partitions the set $({\text{fuzzer}}, {\text{sanitizer}})$3 of relevant source artifacts into semantic groups (e.g., input-parsing, transformation) and summarizes each via a call table and short narrative. The LLM thus operates on highly relevant, token-efficient representations, improving reasoning across complex dependency chains. The compression function follows:

$({\text{fuzzer}}, {\text{sanitizer}})$4

5. Workflow Integration with OSS-Fuzz

End-to-end deployment within the OSS-Fuzz environment proceeds via a structured sequence:

1. Project Onboarding: Installation of custom libFuzzer harness for target project.
2. Static Phase: Execution of Fuzz Introspector for extraction and indexation of call graph and reachability sets.
3. Worker Launch: Parallel pipelines initiated per $({\text{fuzzer}}, {\text{sanitizer}})$5 pair, running the agent workflow.
4. Report & PoC: Upon a sanitizer-detected crash at program location $({\text{fuzzer}}, {\text{sanitizer}})$6, the Report Agent collates call stack, refines SP description, and outputs both JSON and Markdown advisories; optionally triggering GitHub notifications.
5. Reproduction Guarantee: For each report, crash input $({\text{fuzzer}}, {\text{sanitizer}})$7 satisfies:

$({\text{fuzzer}}, {\text{sanitizer}})$8

ensuring deterministic, sanitizer-backed reproduction. OSS-Fuzz’s CI infrastructure replays findings to prevent future regressions.

6. Empirical Evaluation

AIxCC 2025 C/C++ Dataset:

• FuzzingBrain V2 achieved a 90% detection rate (36/40 vulnerabilities), outperforming the nearest competitor by seven findings.
• In Delta-scan mode, 18/20 bugs were found in an average 12 minutes and $({\text{fuzzer}}, {\text{sanitizer}})$935.2.</li> <li>SP Verifier exhibited 97.2% recall (35/36), with the lone missed TP recovered through seeds from a high-recall <a href="https://www.emergentmind.com/topics/fractional-programming-fp" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">FP</a>.</li> <li><a href="https://www.emergentmind.com/topics/ablation-studies" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Ablation studies</a> demonstrated the performance impact of each architectural component: removing <a href="https://www.emergentmind.com/topics/dynamic-application-security-testing-dast" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">DAST</a> (dynamic analysis) tools reduced findings to 28; omitting SP Verifier reduced success to 30; disabling Direction scheduling slowed Full-scan by 3× and dropped findings to 29; the absence of SP Fuzzer resulted in only 19 shallow finds.</li> <li>In challenging cases with deep call chains or masked triggers, the system solved 9/12 instances (75%), surpassing the champion human-in-the-loop system (5/12). Notable cases (e.g., Leap-Second OOB, Protocol Type Confusion) required dynamic tracing plus LLM reasoning to reach call depths of 10 and 7, which static or random fuzzing approaches failed to achieve.</li> </ul> <p><strong>Real-World OSS-Fuzz Deployment:</strong></p> <ul> <li>Operated across 19 C/C++ projects and 2 Java projects via Jazzer, with budgets of $\mathrm{SP} = \bigl(f,\; P,\; T,\; d,\; s\bigr)$0400 per project.
• Identified 41 unknown vulnerabilities; 26 confirmed by maintainers, 23 fixed, and two assigned CVE IDs (CVE-2026-23874 and CVE-2026-23952).
• Most prevalent bug types were heap buffer overflows and null-pointer dereferences.
• Noteworthy discovery included a write-before-check in a mature UTF-processing library missed by traditional harnesses.

The evidence indicates that a combination of multi-agent LLM-driven abstraction, precise SP granularity, and logic-driven, context-aware dual-layer fuzzing is effective for high-fidelity, scalable zero-day vulnerability discovery, with fully automated, reproducible reporting (Sheng et al., 20 May 2026).