{"id":"https://openalex.org/W7129461070","doi":"https://doi.org/10.48550/arxiv.2602.14345","title":"AXE: An Agentic eXploit Engine for Confirming Zero-Day Vulnerability Reports","display_name":"AXE: An Agentic eXploit Engine for Confirming Zero-Day Vulnerability Reports","publication_year":2026,"publication_date":"2026-02-15","ids":{"openalex":"https://openalex.org/W7129461070","doi":"https://doi.org/10.48550/arxiv.2602.14345"},"language":null,"primary_location":{"id":"pmh:doi:10.48550/arxiv.2602.14345","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":null,"any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5102534201","display_name":"Amirali Sajadi","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Sajadi, Amirali","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5126253088","display_name":"Tu Nguyen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen, Tu","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073349866","display_name":"Kostadin Damevski","orcid":"https://orcid.org/0000-0001-7799-2026"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Damevski, Kostadin","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5126223621","display_name":"Preetha Chatterjee","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chatterjee, Preetha","raw_affiliation_strings":[],"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5102534201"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.54339998960495,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.54339998960495,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.1526000052690506,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.0803999975323677,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8942999839782715},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.6920999884605408},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.691100001335144},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.6758000254631042},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.625},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5712000131607056},{"id":"https://openalex.org/keywords/false-positive-paradox","display_name":"False positive paradox","score":0.49559998512268066},{"id":"https://openalex.org/keywords/secure-coding","display_name":"Secure coding","score":0.4433000087738037},{"id":"https://openalex.org/keywords/isolation","display_name":"Isolation (microbiology)","score":0.4018999934196472}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8942999839782715},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7608000040054321},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.6920999884605408},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.691100001335144},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.6758000254631042},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.625},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5712000131607056},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5611000061035156},{"id":"https://openalex.org/C64869954","wikidata":"https://www.wikidata.org/wiki/Q1859747","display_name":"False positive paradox","level":2,"score":0.49559998512268066},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.4433000087738037},{"id":"https://openalex.org/C2775941552","wikidata":"https://www.wikidata.org/wiki/Q25212305","display_name":"Isolation (microbiology)","level":2,"score":0.4018999934196472},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.39989998936653137},{"id":"https://openalex.org/C118643609","wikidata":"https://www.wikidata.org/wiki/Q189210","display_name":"Web application","level":2,"score":0.36010000109672546},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.35510000586509705},{"id":"https://openalex.org/C31395832","wikidata":"https://www.wikidata.org/wiki/Q1318674","display_name":"Testbed","level":2,"score":0.34610000252723694},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.34130001068115234},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3337000012397766},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.31279999017715454},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.3075999915599823},{"id":"https://openalex.org/C112789634","wikidata":"https://www.wikidata.org/wiki/Q18207010","display_name":"False positives and false negatives","level":3,"score":0.29980000853538513},{"id":"https://openalex.org/C77109596","wikidata":"https://www.wikidata.org/wiki/Q4781497","display_name":"Application security","level":5,"score":0.29789999127388},{"id":"https://openalex.org/C63000827","wikidata":"https://www.wikidata.org/wiki/Q3080428","display_name":"Software portability","level":2,"score":0.27000001072883606},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.26460000872612},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.26460000872612},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.26429998874664307},{"id":"https://openalex.org/C2777120189","wikidata":"https://www.wikidata.org/wiki/Q780067","display_name":"Triage","level":2,"score":0.2632000148296356},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.25999999046325684},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2572999894618988},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2567000091075897},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.25440001487731934},{"id":"https://openalex.org/C2778583558","wikidata":"https://www.wikidata.org/wiki/Q771245","display_name":"Code reuse","level":3,"score":0.25369998812675476}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.48550/arxiv.2602.14345","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},{"id":"doi:10.48550/arxiv.2602.14345","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.14345","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"pmh:doi:10.48550/arxiv.2602.14345","is_oa":true,"landing_page_url":null,"pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vulnerability":[0],"detection":[1,36,99],"tools":[2],"are":[3],"widely":[4],"adopted":[5],"in":[6,33,63,133,177,200],"software":[7],"projects,":[8],"yet":[9],"they":[10],"often":[11],"overwhelm":[12],"maintainers":[13],"with":[14],"false":[15],"positives":[16],"and":[17,48,78,109,161,182],"non-actionable":[18],"reports.":[19],"Automated":[20],"exploitation":[21,67,95,122],"systems":[22],"can":[23,60],"help":[24],"validate":[25],"these":[26],"reports;":[27],"however,":[28],"existing":[29],"approaches":[30],"typically":[31],"operate":[32],"isolation":[34],"from":[35,153],"pipelines,":[37],"failing":[38],"to":[39,101],"leverage":[40],"readily":[41],"available":[42],"metadata":[43,100,138],"such":[44],"as":[45],"vulnerability":[46,72,159,180,197],"type":[47],"source-code":[49],"location.":[50,82],"In":[51],"this":[52],"paper,":[53],"we":[54],"investigate":[55],"how":[56],"reported":[57],"security":[58],"vulnerabilities":[59],"be":[61],"assessed":[62],"a":[64,75,79,89,120,125,134,140,190,194],"realistic":[65],"grey-box":[66,137],"setting":[68],"that":[69,96,148],"leverages":[70],"minimal":[71],"metadata,":[73],"specifically":[74],"CWE":[76],"classification":[77],"vulnerable":[80],"code":[81,107],"We":[83,184],"introduce":[84],"Agentic":[85],"eXploit":[86],"Engine":[87],"(AXE),":[88],"multi-agent":[90],"framework":[91],"for":[92],"Web":[93,179],"application":[94],"maps":[97],"lightweight":[98],"concrete":[102],"exploits":[103],"through":[104,189],"decoupled":[105],"planning,":[106],"exploration,":[108],"dynamic":[110],"execution":[111,163],"feedback.":[112],"Evaluated":[113],"on":[114,193],"the":[115],"CVE-Bench":[116],"dataset,":[117],"AXE":[118,168],"achieves":[119],"30%":[121],"success":[123],"rate,":[124],"3x":[126],"improvement":[127],"over":[128],"state-of-the-art":[129],"black-box":[130],"baselines.":[131],"Even":[132],"single-agent":[135],"configuration,":[136],"yields":[139],"1.75x":[141],"performance":[142],"gain.":[143],"Systematic":[144],"error":[145],"analysis":[146],"shows":[147],"most":[149],"failed":[150],"attempts":[151],"arise":[152],"specific":[154],"reasoning":[155],"gaps,":[156],"including":[157],"misinterpreted":[158],"semantics":[160],"unmet":[162],"preconditions.":[164],"For":[165],"successful":[166],"exploits,":[167],"produces":[169],"actionable,":[170],"reproducible":[171],"proof-of-concept":[172],"artifacts,":[173],"demonstrating":[174],"its":[175],"utility":[176],"streamlining":[178],"triage":[181],"remediation.":[183],"further":[185],"evaluate":[186],"AXE's":[187],"generalizability":[188],"case":[191],"study":[192],"recent":[195],"real-world":[196],"not":[198],"included":[199],"CVE-Bench.":[201]},"counts_by_year":[],"updated_date":"2026-04-04T16:13:02.066488","created_date":"2026-02-18T00:00:00"}