New AI Framework Detects Hidden Memory Flaws in Compiled Software

Security researchers have developed a novel framework that uses AI agents to uncover memory corruption vulnerabilities in compiled code stripped of debugging information—a notoriously difficult detection task.

The challenge with traditional binary analysis is fundamental: when source code is compiled into machine-readable binaries and stripped of human-readable symbols, the evidence of a potential vulnerability becomes fragmented across multiple incomplete views. Current LLM-based tools often fail because they lose track of the crucial facts that actually prove a bug exists, creating what researchers call a semantic gap between available evidence and the reasoning used by the AI.

How Veritas Works#

Researchers at Carnegie Mellon and elsewhere developed Veritas, a three-stage framework that grounds AI reasoning in verifiable program facts:

• Stage 1 (Slicer): A static analysis tool traces data flows through the low-level LLVM intermediate representation, reconstructing the complete source-to-sink chains that characterize vulnerabilities.
• Stage 2 (Discover): An LLM aligns the decompiled code with these IR traces to build concrete vulnerability claims backed by actual evidence.
• Stage 3 (Validator): Multiple AI agents cross-check claims through guided debugging and runtime testing, ensuring findings are genuine rather than false alarms.

By breaking the task into stages and anchoring each step in verifiable artifacts, Veritas sidesteps the trap of agents making claims without auditable justification.

Benchmark Results and Real-World Impact#

In testing on a curated dataset with expert annotations, Veritas achieved 90% recall—catching 9 out of 10 real vulnerabilities—while reporting zero false positives among 623 exhaustively validated candidates. Even in broader audits of less rigorous cases, it triggered only two false alarms.

More significantly, the system discovered a previously unknown memory vulnerability in Apple software that was later confirmed and assigned an official CVE identifier. That real-world finding demonstrates the approach moves beyond laboratory success to produce actionable security intelligence.

Why This Matters#

Current binary analysis tools rely on static pattern matching, dynamic execution traces, or simplistic agent inference—each approach has blind spots. Veritas's combination of (anchoring claims in actual program facts) and sets a higher bar for evidence, reducing both the risk of missing real bugs and the noise of false alerts that plague existing tools.