CHECKLINK AI
AI × Cybersecurity

Research translated into defensive action

Two influential UIUC studies show why tool-enabled AI agents change vulnerability response. This hub separates the measured results from the hype and turns them into practical controls.

Check agent controlsPlan a CVE response
One-day study · arXiv:2404.08144v2

LLM Agents can Autonomously Exploit One-day Vulnerabilities

Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang · University of Illinois Urbana-Champaign

15 reproducible real-world vulnerabilities were evaluated in sandboxed environments.

The GPT-4 agent reached 86.7% pass@5 and 40% pass@1 when it received the CVE description.

Without the CVE description, success fell to 7%, separating vulnerability discovery from exploitation capability.

The paper estimated $3.52 per run and $8.80 per successful exploit under the model pricing and assumptions used at publication time.

Important limitation: This was a small, selected benchmark of reproducible open-source systems. The result is not an 87% success claim for arbitrary software, current models, or real production networks.
Open paper on arXiv ↗Read CheckLink analysis
Multi-agent study · arXiv:2406.01637v2

Teams of LLM Agents can Exploit Zero-Day Vulnerabilities

Yuxuan Zhu, Antony Kellermann, Akul Gupta, Philip Li, Richard Fang, Rohan Bindu, and Daniel Kang · University of Illinois Urbana-Champaign

The v2 benchmark contains 14 reproducible web vulnerabilities whose descriptions were withheld from the tested agent.

HPTSA used a hierarchical planner, a manager, task-specific expert agents, tools, and curated documents.

With GPT-4, HPTSA reached 42% pass@5 and 18% pass@1 in the paper's zero-day setting.

Removing the hierarchy, documents, or task-specific agents materially reduced performance in the paper's ablation tests.

Important limitation: The paper focused on selected open-source web vulnerabilities in sandboxes. Its zero-day setting means the vulnerability description was unavailable to the agent; the benchmark does not prove reliable autonomous discovery across all systems.
Open paper on arXiv ↗Read CheckLink analysis
The careful conclusion

The papers show capability, not certainty

Information changed performance dramatically. A published vulnerability description made exploitation much easier in the one-day benchmark, while discovery remained much harder. Defenders should shorten the time between advisory, inventory, decision, patch, and verification.

Structure changed performance too. The multi-agent result depended on a planner, specialists, documents, tools, and repeated attempts. The defensive mirror is to constrain each identity and tool, separate untrusted input, verify delegated output, and retain an action-level audit trail.

New free tools

Use the research without running an offensive agent

For developers and security teams

AI Agent Security Checklist

Assess agent identity, tool permissions, untrusted content, approvals, multi-agent memory, logging, limits, and incident controls.

Open checklist →
For technical and operational teams

CVE Exposure & Response Planner

Turn affected-version status, exposure, exploitation reports, severity, impact, patch status, and controls into a transparent response sequence.

Open planner →
Manual service

AI Agent Security Review

A defensive architecture review covering authority, tools, approvals, untrusted input, delegation, shared memory, logs, and recovery.

See review scope
Manual service

Rapid CVE Readiness Review

A non-intrusive review of affected versions, asset exposure, vendor guidance, mitigation choices, owners, and verification evidence.

See review scope
2025-2026 defensive context

What newer primary sources add

NIST: tool-access patterns

Distinguishes read-only, constrained-write, and write-capable agents across trusted and untrusted environments.

NIST NCCoE: agent identity and authority

Frames agent identity, authorization, and access management as a distinct deployment problem.

ZeroDayBench: discovery and patching

A newer benchmark reports that frontier agents were not yet capable of autonomously solving its 22 novel find-and-patch tasks.

CheckLink publishes defensive education and planning tools. It does not provide exploit payloads, reproduce withheld prompts, scan targets without authorization, or claim that one benchmark predicts every current model or production environment.