Autonomous Discovery of Logic-based API Vulnerabilities

The talk opens by comparing static analysis, dynamic scanners and LLM-based tooling against logic flaws such as broken access control and privilege escalation. The speakers argue these bugs depend on application state, user roles and multi-step request sequences rather than a single malicious input, so input-focused fuzzing struggles with them. They also point out that LLM agents are slow, limited by context size and reliant on scripts for bulk testing.

The middle of the talk frames the search as a reinforcement learning problem. The application is modeled as a tree of endpoints, request and response pairs, authentication contexts and parameters, which a graph neural network encodes. The agent moves through this graph and can copy values such as identifiers or tokens from one request into another. To train and benchmark it, the team generates many small applications from YAML-defined components, each with vulnerable or patched variants. In a simple demo, the agent reuses another user's token to act on that user's notes, and it reached this path without being given strategies or example traces.

The closing part covers questions about benchmark ground truth, comparisons with Burp-style fuzzing and the need to rebuild the graph for each new application, which can be seeded from a crawl. The speakers said the lab generator will be open-sourced and that the work is early. The practical takeaway is that a dedicated method per vulnerability class may suit logic flaws better than one general-purpose model.