# arXiv cs.AI paper: Agentic symbolic execution finds bugs missed by code inspection [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608) In “Bug Finding With Agentic Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same LLM to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Nov 11, 2026 (2026-11-11). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-13T16:03:05.156Z. First observed: 2026-11-13T07:43:14.074Z. Retrieved: 2026-11-13T16:02:07.580Z. - [Bug Finding With Agentic Symbolic Execution](https://arxiv.org/abs/2611.15596) ## Limits The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories. ## Open question Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated? ## Source-stated The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention. > Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports. - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source-stated In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment. > With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it. - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source-stated The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312. > Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code. - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source-stated The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding. > The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source and contributor context Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Agentic AI AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer. - [Definition reference](https://developers.google.com/machine-learning/glossary#agentic) ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: bae6a03d-fc3f-45b1-8271-3c19dfafdd5e. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T16:03:05.156Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: b2853921c0a6dbf9f064d29eac86dd4010ef3efad22f62b0b1b839faacb9a417. Source text hash: aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6. ## Revision and source-check history ### Version 1 — 2026-11-13T16:03:05.156Z In “Bug Finding With Agentic Symbolic Execution,” George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson describe a system combining CrossHair, a symbolic execution tool, with an AI coding agent. They say symbolic execution’s use is hindered by the work of adding assertions and modeling execution environments such as databases. Their harness addresses both barriers: it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and creates a concrete test for each reported bug, without human intervention. In the evaluation, the synthesized environment let CrossHair execute 81% of 5,406 contracted functions, compared with 4.5% without it. The pipeline found 1,050 bugs, each reproduced by a test against the unmodified application; CrossHair found 221, while a baseline using the same LLM to inspect the code missed 312. The authors report that the methods find different kinds of bugs: CrossHair mostly finds crashes on input-domain corner cases accepted by validation, while inspection mostly finds bugs that produce wrong output. They argue that symbolic execution can supplement inspection-based bug finding. ## Original source arXiv cs.AI · Article Original source date: Nov 11, 2026 (2026-11-11). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-13T16:03:05.156Z. First observed: 2026-11-13T07:43:14.074Z. Retrieved: 2026-11-13T16:02:07.580Z. - [Bug Finding With Agentic Symbolic Execution](https://arxiv.org/abs/2611.15596) ## Limits The reported evaluation covers 1,156,044 lines of Python code across 11 popular open-source Python web applications; the abstract does not establish how the approach performs on other repositories. ## Open question Would the harness find similar bugs in Python repositories beyond the 11 open-source web applications evaluated? ## Source-stated The authors’ harness combines CrossHair with an AI coding agent to add assertions, model a database environment, run symbolic execution, and produce a reproducing test for each reported bug without human intervention. > Without human intervention, it instruments a repository with assertions, synthesizes a constraint-aware symbolic environment for the database, runs symbolic execution, and constructs a concrete test as evidence for each bug it reports. - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source-stated In the evaluation, the synthesized environment enabled CrossHair to execute a much larger share of contracted functions than it could without that environment. > With the synthesized environment, CrossHair executes 81% of the 5,406 contracted functions, against 4.5% without it. - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source-stated The authors report 1,050 bugs reproduced by tests against the unmodified applications; CrossHair found 221, and the same LLM inspecting the code missed 312. > Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code. - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source-stated The authors say the two methods found different kinds of bugs, and conclude that symbolic execution can supplement inspection-based bug finding. > The two find different kinds of bugs: CrossHair's are mostly crashes on input-domain corner cases that validation admits, such as empty strings, missing fields and unusual characters, while inspection's are mostly bugs that produce wrong output. Our framework thus lets symbolic execution supplement - [Supporting source](https://arxiv.org/abs/2611.15596) ## Source and contributor context Granberry, George, Ahrendt, Wolfgang, Gordon, Andy, Johansson, Moa · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Agentic AI AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer. - [Definition reference](https://developers.google.com/machine-learning/glossary#agentic) ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: bae6a03d-fc3f-45b1-8271-3c19dfafdd5e. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: passed by anthropic/claude-opus-5.5 on 2026-11-13T16:03:05.156Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: b2853921c0a6dbf9f064d29eac86dd4010ef3efad22f62b0b1b839faacb9a417. Source text hash: aea3252ac065774abba04437b4d363597f73111b42c7b0f178f71891ae3940f6. ### passed — 2026-11-13T16:03:05.156Z — anthropic/claude-opus-5.5 Publication: bae6a03d-fc3f-45b1-8271-3c19dfafdd5e attribution — pass: The reading correctly attributes the paper to George Granberry, Wolfgang Ahrendt, Andy Gordon and Moa Johansson on arXiv. It keeps the results framed as the authors' reported evaluation and conclusions rather than as independently verified facts. > Authors:George Granberry, Wolfgang Ahrendt, Andy Gordon, Moa Johansson summary — pass: The summary faithfully follows the abstract: the two barriers, the harness steps, the 81% vs 4.5% coverage, the 1,050 reproduced bugs, and the different bug types. Technical terms such as symbolic execution, assertions and contracted functions are kept exactly, consistent with tooltip-based explanation. The title's 'missed by code inspection' matches the 312 bugs the abstract says the baseline missed. The question about generalization follows from the 11-application scope. > Our pipeline finds 1,050 bugs, each reproduced by a test against the unmodified application, 221 of them by CrossHair, and 312 of them are missed by a baseline in which the same LLM inspects the code. date — pass: The listed originalPublished date, 2026-11-11, matches the arXiv v1 submission date. It is not the later feed date of 2026-11-13. > \[Submitted on 11 Nov 2026\] support — pass: Each claim is directly supported by its excerpt. The limitation is correctly scoped to the 11 evaluated applications and does not overstate generality. No benefits, costs or forecasts are invented beyond the authors' stated conclusion that symbolic execution can supplement inspection. > We evaluate our harness on 1,156,044 lines of Python code over 11 popular open-source Python web applications media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access point to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. No public references recorded here yet. [Reference data (JSON)](/readings/e169d608345531e22b704ad5c8af1c191af5219728cfcc1da570aeb5d384614b/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-paper-agentic-symbolic-execution-finds-bugs-missed-e169d608.json)