Search papers, labs, and topics across Lattice.
OpenAnt is an innovative vulnerability discovery system that integrates static program analysis with large language model (LLM) reasoning in a multi-stage pipeline to enhance automated security analysis in large codebases. By decomposing code into manageable analysis units and employing adversarial verification and dynamic testing, OpenAnt significantly reduces the analysis surface and false positive rates while identifying previously unknown vulnerabilities. Evaluation on popular open-source projects demonstrates its effectiveness in maintaining a low-cost analysis while improving the accuracy of vulnerability detection.
OpenAnt can uncover previously unknown vulnerabilities in large codebases while slashing false positive rates by up to 97%.
Automated vulnerability discovery in large codebases remains challenging: traditional static analysis produces high false-positive rates, while dynamic approaches such as fuzzing require substantial infrastructure and often target narrow classes of bugs. Recent advances in large language models (LLMs) enable semantic reasoning about program behavior, but applying LLMs to repository-scale security analysis introduces challenges related to context management, cost, and verification. We present OpenAnt, an open-source vulnerability discovery system that integrates static program analysis with LLM-based reasoning in a multi-stage pipeline. OpenAnt introduces three key techniques. First, codebases are decomposed into self-contained analysis units filtered by reachability from external entry points, reducing the analysis surface by up to 97% while preserving attack-relevant code. Second, candidate vulnerabilities undergo adversarial verification through constrained attacker simulation, where the model evaluates exploitability under realistic attacker capabilities. Third, findings are validated through dynamic verification, in which exploit environments are generated automatically, executed in sandboxed containers, and discarded after use. Evaluation on widely used open-source projects including OpenSSL, WordPress, and Flowise shows that this architecture can identify previously unknown vulnerabilities while maintaining manageable analysis cost and substantially reducing false positives. Our results suggest that closed-loop vulnerability discovery pipelines, combining semantic reasoning with exploit validation, provide a practical path toward scalable automated security analysis. OpenAnt is released as open source under the Apache 2.0 license at https://github.com/knostic/OpenAnt.
