# ConcoLixir: Reactive LLM Discovery Oracles for Python Concolic Testing

arXiv: https://arxiv.org/abs/2606.26545 · HTML: https://mlsanity.com/paper/2606.26545/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 25 Jun 2026.

## Built on by (most cited first, 1 of 1)

- [Agentic Planning for Symbolic Execution](https://mlsanity.com/paper/2608.06397/) (2026)

## Abstract (arXiv)

Concolic testing combines concrete execution with symbolic constraint solving, but Python programs expose recurring limits. Library calls can cause symbolic variables to downgrade to concrete values. Regular expressions, checksums, parsers, and other semantic operations can be hard to solve, and exploration can plateau on already covered paths. We present ConcoLixir, a reactive LLM extension for Python concolic execution. The LLM acts as a discovery oracle, not a replacement for the solver or a correctness oracle. It generates initial seeds, proposes concrete inputs after solver failures, and targets uncovered code when coverage stalls. Each candidate is executed concolically, and only observed coverage and collected path constraints guide later exploration. Across synthetic, real-world, and library targets, ConcoLixir improves mean line coverage over the baseline concolic tester without an LLM oracle by 8.6, 15.1, and 17.0 percentage points. The gains are strongest near semantic barriers and library boundaries, and the full evaluation costs 1.63 in API charges. These results show that bounded LLM discovery can complement symbolic reasoning without replacing it.