Performing AI-Assisted Vulnerability Discovery

When to Use

• During authorized vulnerability research where complex input formats (SQL, URLs, custom/binary protocols) stall a blind fuzzer
• When bootstrapping a coverage-guided fuzzer (AFL++, libFuzzer, Honggfuzz) that needs syntax-valid, security-relevant seeds
• When you have crash candidates and need to scale proof-of-vulnerability (PoV) generation across many agents/models
• When triaging large volumes of real Burp HTTP traffic and want evidence-driven passive analysis + report drafting
• When working under cost/time budgets (bug-bounty, CTF, AIxCC-style cyber reasoning systems)

Critical: Techniques Most Often Missed

Teams either ignore LLMs entirely or paste code and hope. The high-value patterns are about feeding the model coverage feedback and keeping the human/Burp as the source of truth.

1. LLM seed generation for semantic validity (deeper coverage early)

SYSTEM: You are a helpful security engineer.
USER: Write a Python3 program that prints 200 unique SQL injection strings targeting common
anti-pattern mistakes (missing quotes, numeric context, stacked queries). Ensure length <= 256
bytes/string so they survive common length limits.

python3 gen_sqli_seeds.py > seeds.txt
afl-fuzz -i seeds.txt -o findings/ -- ./target @@

Ask for a single self-contained script and tell it to diversify encoding (UTF-8, URL-encoded, UTF-16-LE).

2. Coverage-feedback grammar evolution ("Grammar Guy")

The previous grammar triggered 12 % of the program edges. Functions not reached: parse_auth,
handle_upload. Add / modify rules to cover these.

for epoch in range(MAX_EPOCHS):
    grammar = llm.refine(grammar, feedback=coverage_stats)   # use diff+patch, not full rewrite
    save(grammar, f"grammar_{epoch}.txt")
    coverage_stats = run_fuzzer(grammar)                     # stop when Δcoverage < ε