LATIDIA · Ciberseguridad

¿Cuánto importa el arnés y para quién? Un estudio multimodelo del contexto en el descubrimiento de vulnerabilidades impulsado por LLM

arXiv:2610.28802v1 Announce Type: new Abstract: ¿Cuánto afecta el arnés de un agente al descubrimiento de vulnerabilidades y su valor depende del modelo? Estudiamos 24 configuraciones modelo-corredor utilizando un arnés de código abierto

La noticia

arXiv:2610.28802v1 Announce Type: new Abstract: How much does an agent harness affect vulnerability discovery, and does its value depend on the model? We study 24 model-runner configurations using an open-source harness on a production codebase whose vulnerabilities were non-public at scan time. The pipeline combines static screening, LLM investigation, model self-revalidation, root-cause mapping, independent source review, and isolated proof-of-concept confirmation. Across 265 confirmed security root causes, the largest two-run configuration covers 60.4%, while 14.3% are found by exactly one model. No single configuration covers all observed findings. In a four-model context experiment, moving from a minimal prompt to an engineered prompt with a CodeQL-derived call graph raises criticality-weighted yield by