mlsanityData to 7 Oct 2026

CTIFoundry: An Agent-Native Corpus Scaffold for Cyber Threat Intelligence

arXiv 2608.18613 ↗First posted 19 Aug 2026cs.AI cs.CRcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Cyber threat intelligence (CTI) is increasingly consumed not by human analysts but by LLM agents that compose multi-step investigations at query time. The harness side of this shift has matured rapidly, but the corpus side has not: threat reports and vulnerability databases are still packaged for retrieval-augmented generation, as opaque chunks behind an embedding index. We argue that this substrate, not model capability, is the bottleneck on agentic CTI investigation, and present CTIFoundry, an agent-native corpus scaffold. At build time, CTIFoundry materializes the latent structure of a CTI corpus: a deterministic ontology graph over four authoritative knowledge bases (CVE, CWE, CAPEC, ATT&CK) whose official cross-references become typed, traversable edges; a span-grounded report layer whose canonical, alias-resolved cross-vendor entities index provenance-carrying chunks; and hybrid dense+lexical retrieval surfaces. At query time this structure is exposed through seven typed tools and three procedural skills mounted on a stock, widely-used open-source agent harness. On the public CTIConnect benchmark, swapping only the action surface lifts the identically-harnessed agent from 0.610 to 0.829 overall F1 with gpt-5.4 and from 0.470 to 0.745 with claude-haiku-4-5: a small model on CTIFoundry surpasses a flagship model on the flat substrate. The scaffolded agent is simultaneously more accurate and more efficient: on both Claude models it answers with roughly half the tool calls per question. The ablation distills design principles for matching corpus scaffolding to data modality, in CTI and beyond. Build-time validation guarantees zero fabricated identifiers by construction, and the scaffold sustains 1,168 investigations end-to-end at about 2.6 cents each.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 38 of its 74 references that are in the map. First posted on arXiv 19 Aug 2026.

Builds on

38 of 74 references.

References · 38

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  2. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  3. 2023Toolformer: Language Models Can Teach Themselves to Use Toolscited by 4,072
  4. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  5. 2023Voyager: An Open-Ended Embodied Agent with Large Language Modelscited by 2,081
  6. 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,628
  7. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,411
  8. 2025Search-R1: Training LLMs to Reason and Leverage Search Engines with Reinforcement Learningcited by 1,371
  9. 2025Mem0: Building Production-Ready AI Agents with Scalable Long-Term Memorycited by 722
  10. 2024RAPTOR: Recursive Abstractive Processing for Tree-Organized Retrievalcited by 519
  11. 2025Zep: A Temporal Knowledge Graph Architecture for Agent Memorycited by 372
  12. 2025Agentic Context Engineering: Evolving Contexts for Self-Improving Language Modelscited by 349
26 more
  1. 2024Agent Workflow Memorycited by 342
  2. 2023StructGPT: A General Framework for Large Language Model to Reason over Structured Datacited by 339
  3. 2025R1-Searcher: Incentivizing the Search Capability in LLMs via Reinforcement Learningcited by 322
  4. 2025WebThinker: Empowering Large Reasoning Models with Deep Research Capabilitycited by 320
  5. 2024LightRAG: Simple and Fast Retrieval-Augmented Generationcited by 310
  6. 2024HippoRAG: Neurobiologically Inspired Long-Term Memory for Large Language Modelscited by 273
  7. 2025DeepResearcher: Scaling Deep Research via Reinforcement Learning in Real-world Environmentscited by 268
  8. 2026Meta-Harness: End-to-End Optimization of Model Harnessescited by 248
  9. 2025Agentic Retrieval-Augmented Generation: A Survey on Agentic RAGcited by 242
  10. 2025ZeroSearch: Incentivize the Search Capability of LLMs without Searchingcited by 203
  11. 2025BrowseComp-Plus: A More Fair and Transparent Evaluation Benchmark of Deep-Research Agentcited by 183
  12. 2026Self-Harness: Harnesses That Improve Themselvescited by 79
  13. 2026AutoHarness: improving LLM agents by automatically synthesizing a code harnesscited by 63
  14. 2024CTIBench: A Benchmark for Evaluating LLMs in Cyber Threat Intelligencecited by 61
  15. 2024DocETL: Agentic Query Rewriting and Evaluation for Complex Document Processingcited by 49
  16. 2021AttacKG: Constructing Technique Knowledge Graph from Cyber Threat Intelligence Reportscited by 31
  17. 2026Harness Updating Is Not Harness Benefit: Disentangling Evolution Capabilities in Self-Evolving LLM Agentscited by 28
  18. 2022Looking Beyond IoCs: Automatically Extracting Attack Patterns from External CTIcited by 27
  19. 2026HarnessForge: Joint Harness and Policy Evolution for Adaptive Agent Systemscited by 20
  20. 2021EXTRACTOR: Extracting Attack Behavior from Threat Reportscited by 19
  21. 2017Fonduer: Knowledge Base Construction from Richly Formatted Datacited by 13
  22. 2024CTINexus: Automatic Cyber Threat Intelligence Knowledge Graph Construction Using Large Language Modelscited by 12
  23. 2024Towards Accurate and Efficient Document Analytics with Large Language Modelscited by 11
  24. 2025Abacus: A Cost-Based Optimizer for Semantic Operator Systemscited by 11
  25. 2026NL2LOGIC: AST-Guided Translation of Natural Language into First-Order Logic with Large Language Modelscited by 3
  26. 2025CTIConnect: A Benchmark for Retrieval-Augmented LLMs over Heterogeneous Cyber Threat Intelligencecited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Beyond RAG for Cyber Threat Intelligence: A Systematic Evaluation of Graph-Based and Agentic Retrieval
  2. 2026TACTIC-KG: Toward Small Agent Teams for Cyber Threat Intelligence Knowledge Graph Construction
  3. 2025From Retrieval to Reasoning: A Framework for Cyber Threat Intelligence NER with Explicit and Adaptive Instructions
  4. 2025AURA: A Multi-Agent Intelligence Framework for Knowledge-Enhanced Cyber Threat Attribution
  5. 2026Merging Cyber Threat Intelligence Through Retrieval-Augmented Generation and Small Language Models for Rich Threat Representation
  6. 2025AttackSeqBench: Benchmarking the Capabilities of LLMs for Attack Sequences Understanding
  7. 2026MITRE-SAGE: A Multi-Agent Cybersecurity Question-Answering Model
  8. 2025AthenaBench: A Dynamic Benchmark for Evaluating LLMs in Cyber Threat Intelligence