Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa · Nov 11, 2026
arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection
Markdown · JSON · Original source
In “Bug Finding With Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 11, 2026 (2026-11-11).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-13T16:03:05.156Z. First observed: 2026-11-13T07:43:14.074Z. Retrieved: 2026-11-13T16:02:07.580Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories.
Open question
Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated?
Source-stated
The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention.
Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports.
Source-stated
In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment.
With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it.
Source-stated
The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312.
Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.
Source-stated
The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding.
The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement
Source and contributor context
Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Agentic AI
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Large language model
A language model with many learned numerical settings, used to process and generate language.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: bae6a03d-fc3f-45b1-8271-3c19dfafdd5e.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T16:03:05.156Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: b2853921c0a6dbf9f064d29eac86dd4010ef3efad22f62b0b1b839faacb9a417. Source text hash: aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6.
Revision and source-check history
Version 1 · 2026-11-13T16:03:05.156Z
arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection
In “Bug Finding With Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding.
Original source
cs.AI · Article
Source details
Original source date: Nov 11, 2026 (2026-11-11).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-13T16:03:05.156Z. First observed: 2026-11-13T07:43:14.074Z. Retrieved: 2026-11-13T16:02:07.580Z.
Limits
The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories.
Open question
Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated?
Source-stated
The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention.
Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports.
Source-stated
In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment.
With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it.
Source-stated
The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312.
Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.
Source-stated
The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding.
The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement
Source and contributor context
Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Agentic AI
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Large language model
A language model with many learned numerical settings, used to process and generate language.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: bae6a03d-fc3f-45b1-8271-3c19dfafdd5e.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T16:03:05.156Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: b2853921c0a6dbf9f064d29eac86dd4010ef3efad22f62b0b1b839faacb9a417. Source text hash: aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6.
passed · 2026-11-13T16:03:05.156Z · anthropic/claude-opus-5.5
Publication: bae6a03d-fc3f-45b1-8271-3c19dfafdd5e
attribution — pass: The reading correctly attributes the paper to George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson on arXiv. It keeps the results framed as the authors' reported evaluation and conclusions rather than as independently verified facts.
Authors:George Granberry, Wolfgang Ahrendt, Andy Gordon, Moa Johansson
summary — pass: The summary faithfully follows the abstract: the two barriers, the harness steps, the 81% vs 4.5% coverage, the 1,050 reproduced bugs, and the different bug types. Technical terms such as symbolic execution, assertions and contracted functions are kept exactly, consistent with tooltip-based explanation. The title's 'missed by code inspection' matches the 312 bugs the abstract says the baseline missed. The question about generalization follows from the 11-application scope.
Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.
date — pass: The listed originalPublished date, 2026-11-11, matches the arXiv v1 submission date. It is not the later feed date of 2026-11-13.
[Submitted on 11 Nov 2026]
support — pass: Each claim is directly supported by its excerpt. The limitation is correctly scoped to the 11 evaluated applications and does not overstate generality. No benefits, costs or forecasts are invented beyond the authors' stated conclusion that symbolic execution can supplement inspection.
We evaluate our harness on 1,156,044 lines of Python code over 11 popular open-source Python web applications
media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access point to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referenceA language model with many learned numerical settings, used to process and generate language.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referenceA language model with many learned numerical settings, used to process and generate language.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXiv