Hwiwon Lee

SLYP is an end-to-end agentic pipeline for vulnerability discovery and validation on commercial off-the-shelf binaries without source access. It combines binary exploration with dynamic debugging to produce debugger-verified proofs of concept. SLYP has uncovered 40 critical vulnerabilities in Windows systems, all disclosed to Microsoft, including 31 assigned CVEs.

SEC-bench Pro evaluates whether frontier models can hunt real vulnerabilities in large, complex software systems and reproduce working proof-of-concept inputs. The benchmark contains 344 validated vulnerabilities across the V8 and SpiderMonkey browser engines and the Linux kernel, spanning memory-safety, sandbox, JIT, race-condition, and kernel-subsystem bugs.

KEX-bench evaluates coding agents’ kernel exploit-generation capabilities through fine-grained verification of exploit primitives. It includes 45 tasks covering 40 Linux and Windows vulnerabilities, with outcome checks that distinguish concrete security effects from crashes. Even with a reference proof of concept, the strongest tested configuration solves 68.9% of tasks.

BENZENE is a practical end-to-end root-cause analysis system that uses under-constrained state mutation to generate crashing and non-crashing behaviors for effective and efficient diagnosis.