New tool uses AI to automatically update security exploits across library versions

Security researchers have developed a tool that uses large language models to automatically update software exploits when libraries evolve across different versions. The approach, called Diffploit, addresses a persistent challenge: exploits that prove a vulnerability exists in one version often break when applied to newer or older versions because the underlying code has changed.

The Problem with Version Differences#

When developers create exploits to demonstrate vulnerabilities, they typically target a specific version of a library. As software evolves, code undergoes refactoring, API changes, and other modifications that break these proof-of-concept demonstrations. Reproducing exploits across versions typically requires tedious manual rework, sometimes involving trial-and-error attempts to understand which APIs shifted or which environment dependencies changed.

The issue splits into two categories: changes in how the vulnerability is triggered (such as renamed functions or reorganized interfaces) and failures in the execution environment itself (build errors, missing dependencies, runtime incompatibilities). Existing automated approaches rely mostly on fuzzing and low-level code tracing, which are slow and often insufficient to handle these environmental breakdowns.

How Diffploit Works#

Diffploit takes a two-part approach. The system first analyzes the differences between a vulnerable version and a target version, cataloging which code segments changed and what the specific failure symptoms are when running the original exploit. This diagnostic phase generates what the team calls "contexts"—summaries that pinpoint both the technical failure and the relevant code modifications.

Next, an LLM-powered migration engine iteratively refines the exploit. Rather than making a single guess at the fix, it proposes candidate adaptations based on the context, tests them, gathers feedback on what still fails, and repeats the process until the exploit works. This loop balances exploration of different possibilities with gradual, targeted refinement.

Results and Impact#

Testing on 102 Java vulnerabilities spanning 689 version transitions across 79 different libraries, Diffploit successfully migrated 84.2% of exploits automatically. The approach substantially outperformed two competing methods: a change-aware test repair tool called TARGET (which succeeded in just 32% of cases) and an IDE-based rule system (22.6% success).

Beyond raw migration success, the tool uncovered quality issues in the security landscape itself. Researchers identified five CVE disclosures with incorrect version ranges marking which versions were affected—three of which have already been confirmed by vulnerability databases. The method also flagged 111 previously unreported vulnerable versions that were absent from the GitHub Advisory Database.