{"id":"https://openalex.org/W7155057334","doi":"https://doi.org/10.48550/arxiv.2604.17860","title":"TitanCA: Lessons from Orchestrating LLM Agents to Discover 100+ CVEs","display_name":"TitanCA: Lessons from Orchestrating LLM Agents to Discover 100+ CVEs","publication_year":2026,"publication_date":"2026-04-20","ids":{"openalex":"https://openalex.org/W7155057334","doi":"https://doi.org/10.48550/arxiv.2604.17860"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2604.17860","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.17860","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2604.17860","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5134177291","display_name":"Ting Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Ting","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134138602","display_name":"Yikun Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Yikun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134122138","display_name":"Chengran Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Chengran","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009224648","display_name":"Ratnadira Widyasari","orcid":"https://orcid.org/0000-0001-8190-5458"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Widyasari, Ratnadira","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134128446","display_name":"Yue Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052053211","display_name":"Ngoc Tan Bui","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bui, Ngoc Tan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134123889","display_name":"Phuc Thanh Nguyen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen, Phuc Thanh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134143222","display_name":"Yan Naing Tun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tun, Yan Naing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5059690191","display_name":"Ivana Clairine Irsan","orcid":"https://orcid.org/0000-0001-6350-2700"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Irsan, Ivana Clairine","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101913899","display_name":"Huu Hung Nguyen","orcid":"https://orcid.org/0000-0002-7098-1102"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nguyen, Huu Hung","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134103341","display_name":"Huihui Huang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Huang, Huihui","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5001916527","display_name":"Jinfeng Jiang","orcid":"https://orcid.org/0000-0003-1341-1119"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jiang, Jinfeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134096872","display_name":"Lwin Khin Shar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shar, Lwin Khin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5041682105","display_name":"Eng Lieh Ouh","orcid":"https://orcid.org/0000-0001-7759-348X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ouh, Eng Lieh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5134104406","display_name":"David Lo","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lo, David","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5027335548","display_name":"Hong Jin Kang","orcid":"https://orcid.org/0000-0001-7335-7295"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kang, Hong Jin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102693046","display_name":"Yide Yin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yin, Yide","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5134125553","display_name":"Wen Bin Leow","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Leow, Wen Bin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.4156999886035919,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.4156999886035919,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.2888000011444092,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.06729999929666519,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6150000095367432},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5917999744415283},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.5067999958992004},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.40549999475479126},{"id":"https://openalex.org/keywords/software-security-assurance","display_name":"Software security assurance","score":0.35040000081062317},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.34599998593330383},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.33889999985694885}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6176000237464905},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6150000095367432},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5917999744415283},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5684000253677368},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.5067999958992004},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.40549999475479126},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.3882000148296356},{"id":"https://openalex.org/C62913178","wikidata":"https://www.wikidata.org/wiki/Q7554361","display_name":"Software security assurance","level":4,"score":0.35040000081062317},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.34599998593330383},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.33889999985694885},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.31119999289512634},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2912999987602234},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C22680326","wikidata":"https://www.wikidata.org/wiki/Q7444867","display_name":"Secure coding","level":5,"score":0.2773999869823456},{"id":"https://openalex.org/C2777516300","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data discovery","level":3,"score":0.2750999927520752},{"id":"https://openalex.org/C131275738","wikidata":"https://www.wikidata.org/wiki/Q7445023","display_name":"Security bug","level":5,"score":0.25519999861717224},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.25380000472068787},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.2531000077724457},{"id":"https://openalex.org/C2993493390","wikidata":"https://www.wikidata.org/wiki/Q5453208","display_name":"First line","level":2,"score":0.251800000667572}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2604.17860","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.17860","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2604.17860","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2604.17860","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.6455801725387573,"id":"https://metadata.un.org/sdg/9","display_name":"Industry, innovation and infrastructure"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Software":[0],"vulnerabilities":[1,73],"remain":[2],"one":[3],"of":[4,27],"the":[5,24,80],"most":[6],"persistent":[7],"threats":[8],"to":[9],"modern":[10],"digital":[11],"infrastructure.":[12],"While":[13],"static":[14],"application":[15],"security":[16],"testing":[17],"(SAST)":[18],"tools":[19],"have":[20],"long":[21],"served":[22],"as":[23],"first":[25],"line":[26],"defense,":[28],"they":[29],"suffer":[30],"from":[31,93],"high":[32],"false-positive":[33],"rates.":[34],"This":[35],"article":[36],"presents":[37],"TitanCA,":[38],"a":[39,58],"collaborative":[40],"project":[41],"between":[42],"Singapore":[43,48],"Management":[44],"University":[45],"and":[46,74,87,89,95],"GovTech":[47],"that":[49],"orchestrates":[50],"multiple":[51],"large":[52],"language":[53],"model":[54],"(LLM)-powered":[55],"agents":[56],"into":[57],"unified":[59],"vulnerability":[60,99],"discovery":[61,100],"pipeline.":[62],"Applied":[63],"in":[64,102],"open-source":[65],"software,":[66],"TitanCA":[67],"has":[68],"discovered":[69],"203":[70],"confirmed":[71],"zero-day":[72],"yielded":[75],"118":[76],"CVEs.":[77],"We":[78],"describe":[79],"four-module":[81],"architecture,":[82],"i.e.,":[83],"matching,":[84],"filtering,":[85],"inspection,":[86],"adaptation,":[88],"share":[90],"key":[91],"lessons":[92],"building":[94],"deploying":[96],"an":[97],"LLM-based":[98],"solution":[101],"practice.":[103]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-04-22T00:00:00"}