{"id":"e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b","title":"arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection","argument":"In “Bug Finding With Agentic Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same LLM to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories.","speaker":{"name":"Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa","roleAtSource":"Article author"},"source":{"title":"Bug Finding With Agentic Symbolic Execution","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.15596","publishedAt":"2026-11-11","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention.","excerpt":"Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports.","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"},{"text":"In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment.","excerpt":"With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it.","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"},{"text":"The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312.","excerpt":"Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"},{"text":"The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding.","excerpt":"The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15596","checkedAt":"2026-11-14T00:34:07.626Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection","summary":"In “Bug Finding With Agentic Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same LLM to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding.","question":"Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated?","claims":[{"text":"The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention.","excerpt":"Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports.","support":"source-stated"},{"text":"In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment.","excerpt":"With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it.","support":"source-stated"},{"text":"The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312.","excerpt":"Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.","support":"source-stated"},{"text":"The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding.","excerpt":"The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement","support":"source-stated"}],"limitations":["The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories."],"mediaId":"b7aab215637e837b995e01695f80cde95858453d22529e5ec63e2c1b9b16e14b","correctionReason":null,"id":"e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b","publicationId":"bae6a03d-fc3f-45b1-8271-3c19dfafdd5e","version":1,"sourceUrl":"https://arxiv.org/abs/2611.15596","sourceTitle":"Bug Finding With Agentic Symbolic Execution","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-11","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-13T07:43:14.074Z","createdAt":"2026-11-13T16:03:05.156Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"b7aab215637e837b995e01695f80cde95858453d22529e5ec63e2c1b9b16e14b","kind":"article","url":"https://arxiv.org/abs/2611.15596","sourceUrl":"https://arxiv.org/abs/2611.15596","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T16:02:07.863Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15596","checkedAt":"2026-11-14T00:34:07.626Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v7","mediaId":"b7aab215637e837b995e01695f80cde95858453d22529e5ec63e2c1b9b16e14b","confidence":0.63,"provider":"typesafe","model":"jev-1.13.0","inputHash":"55764f1127c811caac87f7204227b3b23562ef48973d213f5c5119c5127cb85b","decidedAt":"2026-11-13T16:02:09.074Z"},"provenance":{"textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observationId":"b2853921c0a6dbf9f064d29eac86dd4010ef3efad22f62b0b1b839faacb9a417","retrievedAt":"2026-11-13T16:02:07.580Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"56f66fa3-15c8-4736-845f-e6ed2e9d5da9"},"reviewer":{"model":"gpt-6-luna","runId":"f2da40ab-8f49-45cc-81a6-c9c208021cac"}},"audit":{"status":"passed","reviewedAt":"2026-11-13T16:03:05.156Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Granberry, George","url":null,"kind":"unknown"},{"name":"Ahrendt, Wolfgang","url":null,"kind":"unknown"},{"name":"Gordon, Andy","url":null,"kind":"unknown"},{"name":"Johansson, Moa","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Granberry, George","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Granberry, George","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}},{"actor":{"name":"Ahrendt, Wolfgang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Ahrendt, Wolfgang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}},{"actor":{"name":"Gordon, Andy","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Gordon, Andy","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}},{"actor":{"name":"Johansson, Moa","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Johansson, Moa","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.15596","snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608","formats":{"html":"/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608","markdown":"/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608.md","json":"/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"conditions":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-agentic","name":"Agentic AI","explanation":"AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.","referenceUrl":"https://developers.google.com/machine-learning/glossary#agentic"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b","revision":"bae6a03d-fc3f-45b1-8271-3c19dfafdd5e","revisionKind":"publication-id","title":"arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection","url":"https://escapemeridian.com/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.15596","revision":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","revisionKind":"sha256-source-text","title":"Bug Finding With Agentic Symbolic Execution","url":"https://arxiv.org/abs/2611.15596"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b","title":"arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection","argument":"In “Bug Finding With Agentic Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same LLM to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories.","speaker":{"name":"Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa","roleAtSource":"Article author"},"source":{"title":"Bug Finding With Agentic Symbolic Execution","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.15596","publishedAt":"2026-11-11","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention.","excerpt":"Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports.","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"},{"text":"In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment.","excerpt":"With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it.","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"},{"text":"The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312.","excerpt":"Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"},{"text":"The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding.","excerpt":"The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement","url":"https://arxiv.org/abs/2611.15596","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15596","checkedAt":"2026-11-14T00:34:07.626Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection","summary":"In “Bug Finding With Agentic Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same LLM to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding.","question":"Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated?","claims":[{"text":"The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention.","excerpt":"Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports.","support":"source-stated"},{"text":"In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment.","excerpt":"With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it.","support":"source-stated"},{"text":"The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312.","excerpt":"Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code.","support":"source-stated"},{"text":"The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding.","excerpt":"The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement","support":"source-stated"}],"limitations":["The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories."],"mediaId":"b7aab215637e837b995e01695f80cde95858453d22529e5ec63e2c1b9b16e14b","correctionReason":null,"id":"e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b","publicationId":"bae6a03d-fc3f-45b1-8271-3c19dfafdd5e","version":1,"sourceUrl":"https://arxiv.org/abs/2611.15596","sourceTitle":"Bug Finding With Agentic Symbolic Execution","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-11","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-13T07:43:14.074Z","createdAt":"2026-11-13T16:03:05.156Z","historical":false,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"b7aab215637e837b995e01695f80cde95858453d22529e5ec63e2c1b9b16e14b","kind":"article","url":"https://arxiv.org/abs/2611.15596","sourceUrl":"https://arxiv.org/abs/2611.15596","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-13T16:02:07.863Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.15596","checkedAt":"2026-11-14T00:34:07.626Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v7","mediaId":"b7aab215637e837b995e01695f80cde95858453d22529e5ec63e2c1b9b16e14b","confidence":0.63,"provider":"typesafe","model":"jev-1.13.0","inputHash":"55764f1127c811caac87f7204227b3b23562ef48973d213f5c5119c5127cb85b","decidedAt":"2026-11-13T16:02:09.074Z"},"provenance":{"textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observationId":"b2853921c0a6dbf9f064d29eac86dd4010ef3efad22f62b0b1b839faacb9a417","retrievedAt":"2026-11-13T16:02:07.580Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"56f66fa3-15c8-4736-845f-e6ed2e9d5da9"},"reviewer":{"model":"gpt-6-luna","runId":"f2da40ab-8f49-45cc-81a6-c9c208021cac"}},"audit":{"status":"passed","reviewedAt":"2026-11-13T16:03:05.156Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Granberry, George","url":null,"kind":"unknown"},{"name":"Ahrendt, Wolfgang","url":null,"kind":"unknown"},{"name":"Gordon, Andy","url":null,"kind":"unknown"},{"name":"Johansson, Moa","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Granberry, George","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Granberry, George","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}},{"actor":{"name":"Ahrendt, Wolfgang","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Ahrendt, Wolfgang","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}},{"actor":{"name":"Gordon, Andy","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Gordon, Andy","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}},{"actor":{"name":"Johansson, Moa","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Johansson, Moa","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.15596","locator":"head/meta[name=author|citation_author]"},"assertionId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-14T00:34:07.626Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","sourceUrl":"https://arxiv.org/abs/2611.15596","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.15596","snapshotId":"135e9211b082eb07d6f2b8eafb9f4634f1482e9107d502c9a6e9d59ea1789b7b","contentSha256":"2bbbc20ac625a9feb2edf1c620d6c06f7f32d5d18ec1b28c523677874a792f75","textHash":"aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6","observedAt":"2026-11-14T00:34:07.626Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b/source"}}}],"audits":[{"publicationId":"bae6a03d-fc3f-45b1-8271-3c19dfafdd5e","verdict":"passed","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly attributes the paper to George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson on arXiv. It keeps the results framed as the authors' reported evaluation and conclusions rather than as independently verified facts.","excerpt":"Authors:George Granberry, Wolfgang Ahrendt, Andy Gordon, Moa Johansson"},{"dimension":"summary","status":"pass","explanation":"The summary faithfully follows the abstract: the two barriers, the harness steps, the 81% vs 4.5% coverage, the 1,050 reproduced bugs, and the different bug types. Technical terms such as symbolic execution, assertions and contracted functions are kept exactly, consistent with tooltip-based explanation. The title's 'missed by code inspection' matches the 312 bugs the abstract says the baseline missed. The question about generalization follows from the 11-application scope.","excerpt":"Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code."},{"dimension":"date","status":"pass","explanation":"The listed originalPublished date, 2026-11-11, matches the arXiv v1 submission date. It is not the later feed date of 2026-11-13.","excerpt":"[Submitted on 11 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim is directly supported by its excerpt. The limitation is correctly scoped to the 11 evaluated applications and does not overstate generality. No benefits, costs or forecasts are invented beyond the authors' stated conclusion that symbolic execution can supplement inspection.","excerpt":"We evaluate our harness on 1,156,044 lines of Python code over 11 popular open-source Python web applications"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access point to the source.","excerpt":null}],"createdAt":"2026-11-13T16:03:05.156Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}