Program Analysis Guided LLM Agent for Proof-of-Concept Generation
2026-04-08 • Software Engineering
Software Engineering
AI summaryⓘ
The authors address the problem of automatically creating proof-of-concept (PoC) inputs that reliably trigger software vulnerabilities given the source code and a suspected problematic spot. Existing methods like symbolic execution and fuzzing need expert help and don't scale well, while large language models (LLMs) alone have low success rates. They propose PAGENT, a new tool that combines simple static code analysis with dynamic profiling to guide PoC generation. Their hybrid approach works much better than previous methods, improving success rates by 132%.
proof-of-concept (PoC)software vulnerabilitysymbolic executionfuzzingstatic analysisdynamic analysissanitizercoverage profilinglarge language models (LLMs)automated exploit generation
Authors
Achintya Desai, Md Shafiuzzaman, Wenbo Guo, Tevfik Bultan
Abstract
Software developers frequently receive vulnerability reports that require them to reproduce the vulnerability in a reliable manner by generating a proof-of-concept (PoC) input that triggers it. Given the source code for a software project and a specific code location for a potential vulnerability, automatically generating a PoC for the given vulnerability has been a challenging research problem. Symbolic execution and fuzzing techniques require expert guidance and manual steps and face scalability challenges for PoC generation. Although recent advances in LLMs have increased the level of automation and scalability, the success rate of PoC generation with LLMs remains quite low. In this paper, we present a novel approach called Program Analysis Guided proof of concept generation agENT (PAGENT) that is scalable and significantly improves the success rate of automated PoC generation compared to prior results. PAGENT integrates lightweight and rule-based static analysis phases for providing static analysis guidance and sanitizer-based profiling and coverage information for providing dynamic analysis guidance with a PoC generation agent. Our experiments demonstrate that the resulting hybrid approach significantly outperforms the prior top-performing agentic approach by 132% for the PoC generation task.