An assembly line for CVEs, staffed by LLM agents

What it does

AutoCVE runs a multi-agent pipeline that handles the full vulnerability-research lifecycle from project selection to CVE filing. An orchestrator dispatches Recon, Scan, Triage, Finding, and Verification agents to audit source code, filter false positives, verify exploits, and output structured reports. The goal is to shrink the gap between spotting an interesting repository and submitting a finished CVE entry.

The interesting bit

The Finding Agent does the heavy lifting through a ReAct loop with dedicated tool calls, “nudge” correction, and a FinalizeFinding hard stop that forces structured, CVE-worthy output instead of meandering LLM prose. The README claims 30 CVEs across 14 projects in a seven-day test period, including a CVSS 9.9 authorization bypass.

Key highlights

• Multi-agent workflow with distinct roles: reconnaissance, scanning, triage, deep finding, and verification.
• Three audit modes ranging from quick tool-scan triage to deep “smart audit” for CVE and 0-day research.
• Interactive sessions let users interrogate the audit trail and ask agents to fill evidence gaps or explain attack chains.
• Skills system allows per-agent capability extensions without rearchitecting the pipeline.
• FastAPI backend and React frontend with PostgreSQL; the UI visualizes agent trees, tool calls, and stage progress.

Caveats

• The primary README is written in Chinese; English documentation exists but appears secondary.
• The published CVE table lists 2026 identifiers, which are provisional or reserved rather than fully disclosed entries.

Verdict

Security researchers and bug hunters who want to automate the tedious audit-to-report pipeline should take a look; teams needing battle-tested, enterprise-grade assurance may want to wait for broader community validation.