Researchers from UC Santa Barbara and the security firm fuzz.land have developed a system called AgentFlow that automatically assembles teams of AI agents to hunt for software vulnerabilities. The system creates a "harness"—a program that coordinates the roles, communication, tool allocation, and retry logic for multiple AI agents. Their paper notes that even with the same underlying AI model, tweaking this harness can change success rates by several times. Most current approaches, however, rely on manual harness writing or only search a limited design space.
AgentFlow uses a typed graph-based domain-specific language (DSL) to unify five harness dimensions—roles, topology, message patterns, tool bindings, and coordination protocols—into an editable graph program. A single editing step can simultaneously add or modify agents, change the network topology, update prompts, and swap tool sets. An outer loop uses runtime signals from the target program, like code coverage and sanitizer reports, to pinpoint failure points, replacing simple pass/fail feedback. On the TerminalBench-2 benchmark, AgentFlow paired with Anthropic's Claude Opus 4.6 achieved an 84.3% success rate (75 out of 89 tasks), the highest score in its category on that leaderboard.
When unleashed on the Chrome codebase—a sprawling 35 million lines of C/C++—the system synthesized a harness with 18 distinct roles and roughly 210 agents. This included 7 subsystem analyzers, 192 parallel explorers, and a four-stage crash classification pipeline. Dedicated agents like a Crash Filter and a Root Cause Analyzer used unique ASAN (AddressSanitizer) crash signatures to deduplicate findings. Running the open-source Kimi K2.5 model on 192 NVIDIA H100 GPUs for seven days, the system discovered 10 zero-day vulnerabilities, all confirmed by Chrome's Vulnerability Rewards Program (VRP). Six have already received CVE identifiers, affecting components like WebCodecs, Proxy, Network, Codecs, and Rendering. The bug types include use-after-free (UAF), integer overflows, and heap buffer overflows. Two of them, CVE-2026-5280 and CVE-2026-6297, are rated Critical and are sandbox escape vulnerabilities.
Shou Chaofan, co-founder of fuzz.land, noted that some of the vulnerabilities were initially found using MiniMax's M2.5 model, and that both MiniMax M2.5 and Claude Opus 4.6 could find most of them. AgentFlow is now open source.