AI-Guided Planning System Triples Branch Coverage in Symbolic Program Execution

Symbolic execution is a long-standing technique for exploring feasible paths through software, but resource constraints often prevent full coverage of program behavior. Researchers have now proposed a fresh angle: instead of relying on a single continuous execution, use an intelligent agent to guide how the tool is deployed across multiple bounded runs.

How Agolic Works#

The new system, called Agolic, functions as an agentic planner that sits atop standard symbolic execution tools. Rather than diving directly into code analysis, it reasons about evidence from earlier runs—such as branch coverage data and prior targeting attempts—to decide how to configure the next execution phase. An LLM-based agent examines source code and replayed coverage information to select which parts of the program to prioritize, then instructs the underlying symbolic execution tool to focus there.

This separation of concerns means the planning layer and the execution layer can adapt independently to different analysis goals and tools.

Evaluation Results#

Testing on C and C++ programs, Agolic substantially outperformed continuous symbolic execution alone. The system covered more than 3× as many branches on average across all test programs and discovered more branches than existing alternatives—including coverage-guided fuzzing and compiler-based concolic execution—when evaluated individually. On six of seven programs, Agolic reached branches that were absent from all comparison corpora combined, suggesting it finds paths that other techniques systematically miss.

Why It Matters#

These findings highlight an overlooked opportunity within existing symbolic execution infrastructure. Much of the tool's latent capability goes untapped because conventional approaches treat each run in isolation or rely on simple heuristics to guide exploration. By adding a reasoning layer that coordinates across runs while delegating the details of state exploration to proven tools, researchers have unlocked substantially better coverage without replacing the underlying engines. This modular approach also means the technique can transfer to different symbolic executors and analysis objectives.