Tag
Project Zero 比较了 LLM 驱动的漏洞挖掘系统 BigSleep 与生成式模糊测试工具 Fuzzilli 在 V8 上的表现：六个月内 BigSleep 发现 45 个漏洞、Fuzzilli 37 个，两者结果存在明显重叠但仍各自独有大量发现，结论是模糊测试与 LLM 互为补充。
研究发现安全漏洞挖掘AI代理60.4%的token用于理解代码与推理触发方式，并提出AVRI工具复用代码关系知识，在Codex和OpenCode上分别降低18.0%和23.7%成本且不损失成功率。
论文指出 LLM 反编译器以可重编译性和重执行性作为主要指标时会产生误导：代码虽然能通过所有自带测试，却可能在其他合法输入上行为发散甚至使已披露漏洞悄然消失。作者提出 Decompile-Diverge 行为比较预言机，通过合成驱动程序和模糊测试语料检测行为差异，发现部分系统发散率高达 13%。
The author discusses building a deterministic hypervisor, explaining the challenges of achieving determinism due to concurrency and hardware issues, while critiquing existing implementations in cybersecurity and virtualization.
The blog post explores the effectiveness of generative testing versus unit tests in discovering bugs, using the Rust regex crate as a case study. It demonstrates how a custom fuzzer found multiple bugs and provides techniques for improving testing approaches.
Lily is an automated tool that integrates backdoor detection into CI pipelines and release vetting workflows to protect open-source software from malicious commits and tampered releases.
Peter Szilagyi reports that Fable introduced a regression into a cryptographic library, which his fuzzer detected, and Fable refused to patch the security issue.
NeuronFuzz is a white-box fuzzing framework that uses internal safety neurons as continuous feedback for evaluating LLM safety against jailbreak attacks, demonstrating high discovery rates across multiple models.
The article explores fuzzing techniques, including LLM-based and structure-aware fuzzing, to find bugs in the Gleam compiler, which compiles to both JavaScript and Erlang with static types.
This paper presents UniHall, a fine-grained hallucination benchmark with a unified taxonomy, and Self-Adaptive Multimodal Fuzzing (SAMF), a self-evolving stress-testing framework for multimodal LLMs. Experiments show SOTA models degrade significantly under fuzzing and reveal a helpfulness-hallucination trade-off.
This article describes using fuzzing to discover an unauthenticated denial-of-service vulnerability in snac2's JSON parser, allowing remote crashes via crafted inputs.
Alex Gaynor argues that the AI-driven 'vulnpocalypse' makes traditional bug-by-bug fixing untenable and calls for systemic security fixes, such as rewriting components in memory-safe languages.
Antithesis describes its custom deterministic hypervisor and subtree deduplication technique for efficient, repeatable whole-system fuzz testing at cloud scale.
This paper presents the first cross-platform reverse engineering and protocol-aware fuzzing study of Apple AirDrop and Android Quick Share, uncovering six vulnerabilities in these widely used proximity transfer protocols.
The author revisits the autofz meta-fuzzer, arguing that its control-plane orchestration approach (managing multiple imperfect workers) is increasingly relevant in the LLM era for security automation, even as the specific fuzzing techniques evolve.
This post describes using Windows PE as a lightweight, stateless testing harness for Windows kernel driver testing and fuzzing, with optimizations for CI/CD pipelines.
Reify is an open-source random C program generator based on semantic reification that produces undefined-behavior-free code for compiler testing. It has already uncovered 59 bugs in GCC and LLVM, plus additional bugs in OpenJ9 and Linux's eBPF runtime.
A security researcher discovered CVE-2026-46529, a 10-year-old remote code execution vulnerability in Linux PDF viewers XReader, Evince, and Atril, caused by insufficient argument quoting when spawning child processes to open remote document links.
A technical blog post describing the author's minimal property-based testing library implemented in ~256 lines of Zig, featuring a Finite Random Number Generator for reproducible test case generation and algorithmic verification.