mlsanityData to 7 Oct 2026

TitanCA: Lessons from Orchestrating LLM Agents to Discover 100+ CVEs

arXiv 2604.17860 ↗First posted 20 Apr 2026cs.CRcited by 2

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Software vulnerabilities remain one of the most persistent threats to modern digital infrastructure. While static application security testing (SAST) tools have long served as the first line of defense, they suffer from high false-positive rates. This article presents TitanCA, a collaborative project between Singapore Management University and GovTech Singapore that orchestrates multiple large language model (LLM)-powered agents into a unified vulnerability discovery pipeline. Applied in open-source software, TitanCA has discovered 203 confirmed zero-day vulnerabilities and yielded 118 CVEs. We describe the four-module architecture, i.e., matching, filtering, inspection, and adaptation, and share key lessons from building and deploying an LLM-based vulnerability discovery solution in practice.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 3 of its 5 references that are in the map. First posted on arXiv 20 Apr 2026.

Builds on

3 of 5 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025Let the Trial Begin: A Mock-Court Approach to Vulnerability Detection using LLM-Based Agents16 May

Other references · 2

  1. 2025Out of Distribution, Out of Luck: How Well Can LLMs Trained on Vulnerability Datasets Detect Top 25 CWE Weaknesses?cited by 5
  2. 2025Semantics-Aligned, Curriculum-Driven, and Reasoning-Enhanced Vulnerability Repair Frameworkcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Harmonizing AI Safety Thresholdscited by 0
  2. 2026The History Is the Detector: Executing CVE Patch History, End-to-Endcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Argus: Reorchestrating Static Analysis via a Multi-Agent Ensemble for Full-Chain Security Vulnerability Detection
  2. 2025From LLMs to Agents: A Comparative Evaluation of LLMs and LLM-based Agents in Security Patch Detection
  3. 2025LLM Agents for Automated Web Vulnerability Reproduction: Are We There Yet?
  4. 2026ZeroDayBench: Evaluating LLM Agents on Unseen Zero-Day Vulnerabilities for Cyberdefense
  5. 2025SEC-bench: Automated Benchmarking of LLM Agents on Real-World Software Security Tasks
  6. 2025Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories
  7. 2026VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities
  8. 2026An Empirical Evaluation of LLM-Based Approaches for Code Vulnerability Detection: RAG, SFT, and Dual-Agent Systems