No, Your Tools Are Not Enough: It's Time to Bring Agents to the Hunt

Modern software systems are large and complex, demanding scalable and autonomous techniques for vulnerability discovery. Existing approaches still depend on human expertise for domain knowledge, and on human intervention throughout the process of vulnerability discovery. AI agents offer us an opportunity to make vulnerability discovery more adaptive, scalable, and autonomous. Agents bring the ability to make continuous decisions and adapt, and general knowledge that can be augmented. In this paper, we present our experience using AI agents to find vulnerabilities across diverse programs such as Windows drivers, the Linux kernel, XNU, firmware, and web applications. We use an iterative agentic workflow and find that it generalizes across these targets. We discuss tasks that agents help with, which were previously challenging, and some future research directions we consider important for advancing autonomous vulnerability discovery.