Hugo Amaro, Instituto Pedro Nunes, Portugal
Sérgio Figueiredo, Instituto Pedro Nunes, Portugal
Pedro Conde, Ethiack, Portugal
Henrique Branquinho, Ethiack, Portugal
The responsible disclosure ecosystem depends on the rapid development and verification of Proof-of-Concepts (PoCs) for newly disclosed vulnerabilities. Although recent work has explored generative and agentic Artificial Intelligence (AI) for PoC generation, existing approaches are often limited to specific ecosystems and frequently suffer from context drift or brittle processing during multi-step exploitation workflows. This paper presents Ethigen, a platform for autonomous vulnerability research, PoC generation, and verification against controlled vulnerable environments. Ethigen introduces a multi-agent orchestration framework that formalizes a three-stage Research–Implementation–Verification workflow with explicit verification contracts and persistent audit trails. The system enforces a disciplined contract–evidence execution loop through specialized agent roles and deterministic Augments that ground agents in executable environments. To improve reliability across repeated analyses, Ethigen incrementally captures reusable execution strategies through a skill-tree mechanism, where successful workflows are distilled into structured procedural knowledge. In preliminary evaluations across 11 diverse Remote Code Execution (RCE) vulnerabilities, Ethigen successfully generated and verified 9 PoCs, against 6 success cases using Claude Code. The results show that combining machine-checkable verification harnesses with reusable procedural knowledge enables more reliable and reproducible vulnerability validation.