KLEECopilot uses LLMs to find 87 unique vulnerabilities, beating baselines by 32%

Symbolic execution is a powerful technique for discovering security vulnerabilities, but it suffers from path explosion—engines like KLEE often waste exploration budgets cycling through repeated branching regions. Researchers from Kyushu University propose KLEECopilot, a directed symbolic execution approach that leverages Large Language Models (LLMs) to guide path prioritization toward likely vulnerable code. By integrating a loop-exit prioritization mechanism, KLEECopilot escapes non-vulnerable cycles and progresses deeper into the program to uncover hidden bugs. In experiments, KLEECopilot achieved a 42.24% improvement in basic block coverage and a striking 125.82% improvement in line coverage over baselines such as Empc.

The approach discovered 1,335 total violations and 87 unique violations, outperforming the second-best baseline by 32.2% in total violations and Empc by 24.3% in unique violations. Sensitivity analysis shows KLEECopilot is sensitive to model family (e.g., GPT-4 vs. Llama) but only marginally sensitive to model scale, suggesting that even smaller LLMs can effectively inject security semantics. Ablation studies confirm that removing any component—such as the LLM guidance or loop-exit prioritization—drops unique violations to just 54–61, underscoring the synergy of the combined design. KLEECopilot represents a practical step toward more intelligent, LLM-augmented fuzzing and vulnerability discovery tools.