Agentic AI Fuzzing System Finds Software Vulnerabilities 25x Faster Than Conventional Methods

Researchers have developed PBFuzz, an automated fuzzing system that mimics the methodical work of human security analysts to identify software vulnerabilities far more efficiently than existing tools.

The technique addresses a core challenge in security research: generating proof-of-vulnerability (PoV) inputs that both reach vulnerable code and trigger the actual flaw. Traditional fuzzing and even recent machine-learning-assisted approaches struggle to navigate these dual constraints systematically.

How PBFuzz Works#

Rather than random testing, PBFuzz automates the iterative reasoning process that expert security researchers follow. An analyst typically reads code to identify how to reach vulnerable locations, forms hypotheses about triggering strategies, builds test inputs, and refines understanding based on debugging output. The system encodes this workflow as an autonomous agent that:

• Analyzes code semantically to extract reachability and triggering constraints
• Designs custom program-analysis tools for targeted inference
• Maintains persistent memory to track hypotheses and avoid getting stuck in unproductive directions
• Applies property-based testing to solve constraints while preserving valid input structure

Performance Results#

Testing on the Magma benchmark, PBFuzz triggered 57 vulnerabilities—more than any baseline method—and uniquely exposed 17 flaws that other fuzzers missed. The efficiency gains are substantial: the system required only a 30-minute budget per target, whereas conventional approaches typically run for 24 hours. The median time to uncover a vulnerability dropped to 339 seconds compared to 8,680 seconds for AFL++ with CmpLog, representing a 25.6x improvement.

The approach proved cost-effective in real-world conditions, generating PoVs at approximately USD 1.83 per discovered vulnerability. In production testing, PBFuzz reproduced three previously unreleased FFmpeg CVEs with no public proof-of-concept code available.

Why It Matters#

The acceleration in PoV generation has downstream benefits for security: once a vulnerability is triggered and proven, analysts can better understand attack paths and validate patches. By automating expert-level reasoning, the system democratizes capabilities that previously required specialized human effort.