AXE: An Agentic eXploit Engine for Confirming Zero-Day Vulnerability Reports
This paper introduces AXE, a multi-agent framework that leverages minimal grey-box metadata (CWE classification and code location) to automate the generation of concrete exploits for web vulnerabilities, achieving a 30% success rate and significantly outperforming existing black-box baselines in validating zero-day reports.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you are the manager of a massive, busy apartment complex (a software project). Every day, you receive hundreds of letters from tenants and security guards saying, "Hey, I think there's a broken lock on the back door!" or "Someone found a loose floorboard in the basement!"
The problem? Most of these letters are false alarms. Some are just theoretical ("If a ghost walked through the wall, it could fall"), and others are so vague ("The door is broken") that you don't know which door they mean or how to break it. You, the manager, are drowning in paperwork, trying to figure out which ones are real emergencies and which ones are just noise.
This is exactly the problem software developers face with vulnerability reports. They get flooded with alerts from automated scanners, but most are "false positives" (fake alarms) or too vague to act on.
Enter AXE: The "Detective Squad"
The paper introduces AXE (Agentic eXploit Engine), which is like hiring a team of highly specialized, super-smart detectives to go through those letters and actually try to break the locks to see if they really work.
Here is how AXE works, using simple analogies:
1. The "Grey-Box" Clue
Usually, these detectives are given very little information. They don't get the blueprints of the whole building, and they don't get a map of the broken lock. They only get a tiny note:
- The Clue: "There's a problem with the Back Door (CWE classification)."
- The Location: "It's on the 3rd floor, line 45 of the door manual."
- The Access: They are allowed to look at the door manual (source code) and try to open the door.
This is called a Grey-Box approach. It's not a blind guess (Black-Box), but it's not a full walkthrough either. It's a smart, targeted investigation.
2. The Four-Specialist Team (Multi-Agent)
Instead of one detective trying to do everything (read the manual, pick the lock, and run away), AXE splits the job into a team of four specialists who talk to each other:
- The Strategist (The Brain): This detective looks at the clues and the manual. They come up with a plan: "Okay, if I turn the knob three times and then kick the door, it might open." They are the ones who think, "Wait, maybe I need a key first?"
- The Explorer (The Librarian): When the Strategist gets stuck, they ask the Explorer. The Explorer runs to the library (the source code), finds the specific page about the door, and says, "Hey, the manual says you need a specific key (a 'nonce') before you can even touch the knob."
- The Exploiter (The Lockpicker): This is the hands-on detective. They take the plan and the key info and actually try to break in. They knock, kick, and pick the lock. If it fails, they tell the Strategist exactly why (e.g., "The door jammed because I didn't have the key").
- The PoC Generator (The Reporter): If the lock finally breaks, this person writes a clear, step-by-step manual: "Here is exactly how we broke in, so you can fix it."
3. The "Try, Fail, Learn" Loop
The magic of AXE is that it doesn't give up after one try.
- Attempt 1: The Lockpicker tries to kick the door. Crash! It doesn't open.
- Feedback: The Reporter says, "It failed because you didn't have the key."
- Attempt 2: The Strategist updates the plan. "Okay, Explorer, find the key first." The Explorer finds the key in the manual. The Lockpicker tries again. Click! It opens!
This loop of Plan → Try → Learn → Fix allows AXE to solve puzzles that a single, one-shot AI would fail at.
Why is this a big deal?
The researchers tested AXE on a list of real-world security holes (called CVE-Bench).
- Old Way (Black-Box): If you just guess blindly without looking at the manual, you only succeed about 10% of the time.
- The New Way (AXE): By looking at the manual and using the team approach, AXE succeeded 30% of the time. That's 3 times better.
Even more importantly, when AXE succeeds, it doesn't just say "It's broken." It hands you a Proof-of-Concept (PoC). This is like a video recording of the lock being picked, with a note saying, "To fix this, change the lock to a deadbolt." This saves the building manager (the developer) hours of guessing.
The "Human" Flaws
The paper also looked at why AXE sometimes fails. It turns out, the AI detectives make human-like mistakes:
- Misreading the Clue: They thought the door was broken when it was actually the window.
- Missing the Prep: They tried to kick the door without realizing they needed to unlock the gate first.
- Giving Up Too Soon: They tried a few times, failed, and stopped, not realizing they just needed to try a slightly different angle.
The Bottom Line
AXE is a tool that helps software teams stop wasting time on fake alarms. Instead of a human spending hours trying to figure out if a reported bug is real, AXE acts as a rapid-fire testing squad. It tries to break the software using the limited clues it has. If it succeeds, it gives the developers a clear "You need to fix this" report. If it fails, it tells them, "We tried everything we could with the info we had, and it seems safe," helping them prioritize their work.
It's like having a team of expert locksmiths who can quickly tell you, "Yes, this lock is broken, here is how to fix it," or "No, this lock is fine, stop worrying about it."
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.