ARTIPHISHELL Agents: LLM-Driven Bug Hunting & Patching in Open Source Software
Engineers explore architecture and security mechanisms for ARTIPHISHELL Agents: LLM-Driven Bug Hunting & Patching in Open Source Software.
Summary
DARPA AI Cyber Challenge
Will Gibbs and Lucas Dresl of the Shellphish multi-university team present their HITCON talk on LLM-driven autonomous bug hunting and patching for open source, built for DARPA's AI Cyber Challenge with roughly twenty-six contributors from ASU, UCSB, and Purdue.
Competition scope
AIC targets fully autonomous discovery and repair across hard codebases such as nginx, SQLite, Jenkins, and the Linux kernel. Semifinalists received two-million-dollar prizes; finals added larger awards. Motivations included prize money, giving back to open source, and learning bleeding-edge LLM security uses.
Pipeline overview
Their CRS narrows huge codebases using Semgrep and CodeQL queries, prioritizing delta-mode diffs where new changes introduce or expose bugs. Diffy generates targeted CodeQL queries around patches; Code Swipe heuristically weights candidate functions from diff proximity, static warnings, and reachability before LLMs analyze prioritized code for exploitable issues.
Related talks
BSidesKC·42 min
David Evenden
Analysts investigate attack surfaces and defenses concerning 2019 - David Evenden - Hackers hunting Hackers: An open source exercise on.
Briefings·36 min
Rama Hoetzlein
Industry leaders explore cost-effective defensive architectures and incident response playbooks tailored for small organizations facing modern ransomware threats.
Briefings·26 min
Jiashuo Liang · Guancheng Li
Introduces a novel gradient-based prompt-injection technique that can generate universal triggers to manipulate open-source Large Language Model (LLM) outputs.