{"id":"https://openalex.org/W7224815732","doi":"https://doi.org/10.3390/app162110747","title":"CVE-Pilot: Failure-Aware Tool Orchestration for Code LLM Agents on CVE-Bench","display_name":"CVE-Pilot: Failure-Aware Tool Orchestration for Code LLM Agents on CVE-Bench","publication_year":2026,"publication_date":"2026-10-30","ids":{"openalex":"https://openalex.org/W7224815732","doi":"https://doi.org/10.3390/app162110747"},"language":"en","primary_location":{"id":"doi:10.3390/app162110747","doi":"https://doi.org/10.3390/app162110747","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app162110747","pdf_url":null,"source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","oarl","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},"volume":null,"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.3390/app162110747","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102506855","display_name":"You Zhai","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I82880672","display_name":"Beihang University","ror":"https://ror.org/00wk2mp56","country_code":"CN","type":"education","lineage":["https://openalex.org/I82880672"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"You Zhai","raw_affiliation_strings":["Chinese Academy of Cyberspace Studies, Beijing 100048, China","School of Computer Science and Engineering, Beihang University, Beijing 100191, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Cyberspace Studies, Beijing 100048, China","institution_ids":[]},{"raw_affiliation_string":"School of Computer Science and Engineering, Beihang University, Beijing 100191, China","institution_ids":["https://openalex.org/I82880672"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133578872","display_name":"Shouyou Song","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shouyou Song","raw_affiliation_strings":["Chinese Academy of Cyberspace Studies, Beijing 100048, China","Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications, Beijing 100876, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Cyberspace Studies, Beijing 100048, China","institution_ids":[]},{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications, Beijing 100876, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5160220846","display_name":"Pu Wang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pu Wang","raw_affiliation_strings":["Chinese Academy of Cyberspace Studies, Beijing 100048, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chinese Academy of Cyberspace Studies, Beijing 100048, China","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5160220862","display_name":"Lei Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I173899330","display_name":"Henan University","ror":"https://ror.org/003xyzq10","country_code":"CN","type":"education","lineage":["https://openalex.org/I173899330"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Lei Zhang","raw_affiliation_strings":["School of Computer and Information Engineering, Henan University, Kaifeng 475001, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"School of Computer and Information Engineering, Henan University, Kaifeng 475001, China","institution_ids":["https://openalex.org/I173899330"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5160220862"],"corresponding_institution_ids":["https://openalex.org/I173899330"],"apc_list":{"value":2400,"currency":"CHF","value_usd":2896},"apc_paid":{"value":2400,"currency":"CHF","value_usd":2896},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.88850439,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"16","issue":"21","first_page":"10747","last_page":"10747"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8598999977111816,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.8598999977111816,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.05920000001788139,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.0364999994635582,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/tool-orchestration","display_name":"tool orchestration","score":0.8740000128746033},{"id":"https://openalex.org/keywords/self-training","display_name":"self-training","score":0.7409999966621399},{"id":"https://openalex.org/keywords/zero-day-vulnerabilities","display_name":"zero-day vulnerabilities","score":0.8130000233650208},{"id":"https://openalex.org/keywords/web-application-vulnerabilities","display_name":"web application vulnerabilities","score":0.652999997138977}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8016999959945679},{"id":"https://openalex.org/C167981075","wikidata":"https://www.wikidata.org/wiki/Q2667186","display_name":"Sandbox (software development)","level":2,"score":0.5888000130653381},{"id":"https://openalex.org/C199168358","wikidata":"https://www.wikidata.org/wiki/Q3367000","display_name":"Orchestration","level":3,"score":0.54339998960495},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5332000255584717},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.48399999737739563},{"id":"https://openalex.org/C186644900","wikidata":"https://www.wikidata.org/wiki/Q194152","display_name":"Parsing","level":2,"score":0.448199987411499},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.4334000051021576},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.38909998536109924},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.35190001130104065},{"id":"https://openalex.org/C198531522","wikidata":"https://www.wikidata.org/wiki/Q485146","display_name":"Sample (material)","level":2,"score":0.34689998626708984},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3409000039100647},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.32510000467300415},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.29490000009536743},{"id":"https://openalex.org/C28719098","wikidata":"https://www.wikidata.org/wiki/Q44946","display_name":"Point (geometry)","level":2,"score":0.29089999198913574},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.2565999925136566},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.25540000200271606}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.3390/app162110747","doi":"https://doi.org/10.3390/app162110747","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app162110747","pdf_url":null,"source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","oarl","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.3390/app162110747","doi":"https://doi.org/10.3390/app162110747","is_oa":true,"landing_page_url":"https://doi.org/10.3390/app162110747","pdf_url":null,"source":{"id":"https://openalex.org/S4210205812","display_name":"Applied Sciences","issn_l":"2076-3417","issn":["2076-3417"],"is_oa":true,"is_in_doaj":true,"is_core":true,"listed_in":["anvur-class-a","anvur-scientific","cwts-core","doaj","norway-1","oarl","poland-100","russia-white-list-2","vabb-shw"],"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Applied Sciences","raw_type":"journal-article"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":2,"referenced_works":["https://openalex.org/W7088458179","https://openalex.org/W7103754783"],"related_works":["https://openalex.org/W7133506238","https://openalex.org/W7214753479","https://openalex.org/W7133328784","https://openalex.org/W4416012576","https://openalex.org/W7155418920","https://openalex.org/W4411120547","https://openalex.org/W7212057518","https://openalex.org/W7223726569","https://openalex.org/W4417093500","https://openalex.org/W7155057334"],"abstract_inverted_index":{"CVE-Bench":[0,90],"evaluates":[1],"large":[2],"language":[3],"model":[4],"(LLM)":[5],"agents":[6],"on":[7],"40":[8],"real-world,":[9],"critical-severity":[10],"web":[11],"application":[12],"CVEs":[13],"in":[14,111,117],"containerized":[15],"sandboxes.":[16],"The":[17,132,147],"strongest":[18],"reported":[19],"baseline":[20],"solves":[21],"10.0%":[22],"of":[23,28,44,109,161],"zero-day":[24,113],"tasks":[25,30],"and":[26,42,69,80,83,94,115,129,143,154],"12.5%":[27],"one-day":[29,119],"after":[31],"five":[32],"attempts.":[33],"Common":[34],"failures":[35],"include":[36],"missed":[37],"endpoints,":[38,65],"incorrect":[39],"tool":[40,67,76],"configuration,":[41],"loss":[43],"evidence":[45,141],"needed":[46],"for":[47],"subsequent":[48],"actions.":[49],"We":[50],"present":[51],"CVE-Pilot,":[52],"a":[53,59,158],"code":[54],"LLM":[55],"agent":[56],"that":[57],"uses":[58],"typed":[60],"state":[61],"graph":[62],"to":[63,127],"record":[64],"credentials,":[66],"outputs,":[68],"failed":[70],"hypotheses.":[71],"Coverage-guided":[72],"planning":[73],"directs":[74],"exploration,":[75],"contracts":[77],"check":[78],"execution":[79],"parse":[81],"results,":[82],"target-aware":[84],"verification":[85],"tests":[86],"the":[87,103,112,118],"eight":[88],"standard":[89],"attack":[91],"outcomes.":[92],"Successful":[93],"near-miss":[95],"sandbox":[96],"traces":[97],"support":[98],"self-training":[99,123],"through":[100],"CVE-TraceBank.":[101],"On":[102],"evaluated":[104],"tasks,":[105],"CVE-Pilot":[106],"achieves":[107],"Success@5":[108],"25.0%":[110],"setting":[114],"32.5%":[116,128],"setting.":[120],"CVE-level":[121],"leave-one-out":[122],"increases":[124],"these":[125],"rates":[126],"40.0%,":[130],"respectively.":[131],"gains":[133],"are":[134],"accompanied":[135],"by":[136],"higher":[137],"endpoint":[138],"coverage,":[139],"better":[140],"retention,":[142],"fewer":[144],"exploration":[145],"failures.":[146],"40-CVE":[148],"sample":[149],"yields":[150],"wide":[151],"confidence":[152],"intervals,":[153],"vulnerability":[155],"reasoning":[156],"remains":[157],"major":[159],"source":[160],"failure.":[162]},"counts_by_year":[],"updated_date":"2026-11-04T10:54:05.112534","created_date":"2026-10-31T00:00:00"}