Ulysses verifies web exploit proofs for real applications
Original title: Ulysses: A Security Harness For Synthesizing Verifiable Web Exploits
It confirmed 10 of 25 known advisories and produced four exploitability proofs not previously reported.
Ulysses is a multi-agent harness that turns candidate web-application findings into verified proofs of exploitability. It iterates exploit hypotheses and accepts a result only when success appears in independently observed execution effects. On WebExploitGym, covering exploitable cases from 25 real-world web applications in five languages and seven frameworks, it verified 10 of 25 advisories and reported four new proofs.
Unconfirmed: The paper does not name the applications, advisories, or the four new findings.
- The benchmark spans 25 applications, five languages, and seven frameworks.
- Verification depends on observed execution effects, not the model's own claim.
- The applications and the four new findings are not named.
- No CVE identifiers are given.
Impact: Verified exploitability of web-application vulnerabilities
| Product | Affected |
|---|---|
| WebExploitGym web applications | — |
From the original article
1 min read at arxiv.orgHow can an AI agent automatically discover security vulnerabilities in any software repository? Existing approaches use LLMs to generate software vulnerability exploits. However, it is challenging for an LLM to reliably verify its own generated exploits.
By Aditya Oke · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.