Search

Ethigen - autonomous CVE analysis and PoC verification with contract-driven agents

Contribution type: article

Title: Ethigen – autonomous CVE analysis and PoC verification with contract-driven agents

Authors:

Hugo Amaro, Instituto Pedro Nunes, Portugal
Sérgio Figueiredo, Instituto Pedro Nunes, Portugal
Pedro Conde, Ethiack, Portugal
Henrique Branquinho, Ethiack, Portugal

Keywords: CVE, vulnerability, LLM, multi-agent, PoC verification

Abstract:

The responsible disclosure ecosystem depends on the rapid development and verification of Proof-of-Concepts (PoCs) for newly disclosed vulnerabilities. Although recent work has explored generative and agentic Artificial Intelligence (AI) for PoC generation, existing approaches are often limited to specific ecosystems and frequently suffer from context drift or brittle processing during multi-step exploitation workflows. This paper presents Ethigen, a platform for autonomous vulnerability research, PoC generation, and verification against controlled vulnerable environments. Ethigen introduces a multi-agent orchestration framework that formalizes a three-stage Research–Implementation–Verification workflow with explicit verification contracts and persistent audit trails. The system enforces a disciplined contract–evidence execution loop through specialized agent roles and deterministic Augments that ground agents in executable environments. To improve reliability across repeated analyses, Ethigen incrementally captures reusable execution strategies through a skill-tree mechanism, where successful workflows are distilled into structured procedural knowledge. In preliminary evaluations across 11 diverse Remote Code Execution (RCE) vulnerabilities, Ethigen successfully generated and verified 9 PoCs, against 6 success cases using Claude Code. The results show that combining machine-checkable verification harnesses with reusable procedural knowledge enables more reliable and reproducible vulnerability validation.

Publication Date: June 7, 2026

Presented during:

Dates: June 7, 2026 to June 11, 2026

Location: Porto, Portugal

Venue:

Hotel Novotel Porto Gaia

Rua Martir Sao Sebastiao, Afurada,
4400-499 Vila Nova de Gaia

Hotel website

Copyright (c) DTR Society, 2026

Contact Us

Proposals

The submission system is currently being prepared. We invite you to subscribe to the newsletter so you will be the first to know when it goes online.