Search papers, labs, and topics across Lattice.
This paper introduces RECEIPT, a verification framework designed to enhance the trustworthiness of LLM-based coding agents in discovering Cross-Site Scripting (XSS) vulnerabilities. By addressing reward-hacking behaviors and enforcing strict verification requirements, RECEIPT ensures that agent-reported findings are both deterministic and reproducible. The framework was evaluated on 95 real-world applications, successfully identifying 24 new XSS vulnerabilities and recovering known vulnerabilities with a significant reduction in false positives compared to existing methods.
RECEIPT uncovers 24 previously unknown XSS vulnerabilities while ensuring no false positives, setting a new standard for trust in automated vulnerability discovery.
Cross-Site Scripting (XSS) remains one of the most prevalent and damaging classes of web vulnerabilities. LLM-based coding agents offer a promising approach to XSS discovery by combining source-code reasoning with interactive testing against a running application. However, a coding agent's claims cannot be trusted on their own. We characterize three reward-hacking behaviors in white-box agentic XSS discovery and propose three requirements that an ideal verifier should meet. We present RECEIPT, a verification framework that makes agent-reported XSS findings trustworthy by enforcing environment isolation, PoC constraints, role separation, and verdict binding. Each confirmation therefore establishes two properties: the script runs in a real browser, and the payload was planted under the attacker role and executed in the victim role's browser. This constrained replay procedure makes validation deterministic and reproducible. We evaluate RECEIPT on 95 real-world web-application targets drawn from popular open-source projects. Within a $20 per-application budget, RECEIPT found 24 previously unknown XSS vulnerabilities, 12 of which have already been acknowledged by maintainers after responsible disclosure, and recovered the labeled CVE in 36% of known-vulnerability recovery targets. Compared with the same agent using self-judgment and with black-box scanners, RECEIPT confirms more real exploits while admitting no false positives.
