# VCAO: Verifier-Centered Agentic Orchestration for Strategic OS Vulnerability Discovery

arXiv: https://arxiv.org/abs/2604.08291 · HTML: https://mlsanity.com/paper/2604.08291/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 5 of its 31 references that are in the map.
- First posted on arXiv 9 Apr 2026.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 5 of 5)

- [Chain-of-Verification Reduces Hallucination in Large Language Models](https://mlsanity.com/paper/2309.11495/) (2023)
- [IRIS: LLM-Assisted Static Analysis for Detecting Security Vulnerabilities](https://mlsanity.com/paper/2405.17238/) (2024)
- [KernelGPT: Enhanced Kernel Fuzzing via Large Language Models](https://mlsanity.com/paper/2401.00563/) (2023)
- [Efficient Attack Graph Analysis through Approximate Inference](https://mlsanity.com/paper/1606.07025/) (2016)
- [MEGA-PT: A Meta-Game Framework for Agile Penetration Testing](https://mlsanity.com/paper/2409.14219/) (2024)

## Abstract (arXiv)

We formulate operating-system vulnerability discovery as a repeated Bayesian Stackelberg search game in which a Large Reasoning Model (LRM) orchestrator allocates analysis budget across kernel files, functions, and attack paths while external verifiers -- static analyzers, fuzzers, and sanitizers -- provide evidence. At each round, the orchestrator selects a target component, an analysis method, and a time budget; observes tool outputs; updates Bayesian beliefs over latent vulnerability states; and re-solves the game to minimize the strategic attacker's expected payoff. We introduce textscVCAO (Verifier-Centered Agentic Orchestration), a six-layer architecture comprising surface mapping, intra-kernel attack-graph construction, game-theoretic file/function ranking, parallel executor agents, cascaded verification, and a safety governor. Our DOBSS-derived MILP allocates budget optimally across heterogeneous analysis tools under resource constraints, with formal tildeO(√T) regret bounds from online Stackelberg learning. Experiments on five Linux kernel subsystems -- replaying 847 historical CVEs and running live discovery on upstream snapshots -- show that textscVCAO discovers 2.7× more validated vulnerabilities per unit budget than coverage-only fuzzing, 1.9× more than static-analysis-only baselines, and 1.4× more than non-game-theoretic multi-agent pipelines, while reducing false-positive rates reaching human reviewers by 68%. We release our simulation framework, synthetic attack-graph generator, and evaluation harness as open-source artifacts.