Hybrid Vulnerability Discovery in the Wild: Automated Screening, Fine-Tuned LLMs, and Four Published CVEs
Year: 2026
Type: article
Abstract: Automated security scanners produce many alerts, but disclosure requires evidence of attacker control, reachability, impact, and reproducibility. We present an evidence-gated workflow that screens recently updated Python AI/ML and data-science packages then uses two separately fine-tuned open-weight agents to distinguish vulnerability plausibility from CVE worthiness: the first tests attacker control and reachability, and the second assesses novelty and impact before human proof-of-concept validation and coordinated disclosure. In a targeted campaign covering 400 packages, screening yielded 1292 clustered signals; the agents retained 96 vulnerability hypotheses, including 65 provisional CVE candidates. All 13 Critical or High candidates were reproduced with benign proofs of concept and acknowledged by a CVE Numbering Authority as valid security findings. As of 30 September 2026, four had published CVEs affecting OpenMed, Python StateMachine, uproot, and SpeechBrain; five had maintainer-acknowledged patches in progress; and four awaited maintainer response. Field detection accuracy was not measured.
Source: Electronics
Authors: Sai Teja Erukude, Lior Shamir
Institution: Kansas State University
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
Estimated APC paid: $2,896
OpenAlex ID: W7221786093
FWCI:
Cites:
Cited by:
Related to: