Pith Number

pith:SHCN667R

pith:2026:SHCN667RE4TW5KECA2PMYL7FNR

not attested not anchored not stored refs pending

TitanCA: Lessons from Orchestrating LLM Agents to Discover 100+ CVEs

Chengran Yang, David Lo, Eng Lieh Ouh, Hong Jin Kang, Huihui Huang, Huu Hung Nguyen, Ivana Clairine Irsan, Jinfeng Jiang, Lwin Khin Shar, Ngoc Tan Bui, Phuc Thanh Nguyen, Ratnadira Widyasari, Ting Zhang, Wen Bin Leow, Yan Naing Tun, Yide Yin, Yikun Li, Yue Liu

An orchestrated team of LLM agents discovers 203 zero-day vulnerabilities and yields 118 CVEs in open-source code.

arxiv:2604.17860 v2 · 2026-04-20 · cs.CR

Open paper page JSON Open Graph Bundle Merged state Verified badge What is a Pith Number?

Add to your LaTeX paper

\usepackage{pith}
\pithnumber{SHCN667RE4TW5KECA2PMYL7FNR}

Prints a linked badge after your title and injects PDF metadata. Compiles on arXiv. Learn more · Embed verified badge

Record completeness

1 Bitcoin timestamp

2 Internet Archive

3 Author claim open · sign in to claim

4 Citations open

5 Replications open

✓ Portable graph bundle live · download bundle · merged state

The bundle contains the canonical record plus signed events. A mirror can host it anywhere and recompute the same current state with the deterministic merge algorithm.

Claims

C1strongest claim

Applied in open-source software, TitanCA has discovered 203 confirmed zero-day vulnerabilities and yielded 118 CVEs.

C2weakest assumption

That the vulnerabilities flagged by the LLM pipeline are independently verifiable as true zero-days with low false-positive rates and that the four-module orchestration generalizes beyond the specific projects tested.

C3one line summary

TitanCA's LLM agent pipeline discovered 203 confirmed zero-day vulnerabilities and produced 118 CVEs in open-source software.

Receipt and verification

First computed	2026-06-03T01:05:13.878722Z
Builder	pith-number-builder-2026-05-17-v1
Signature	Pith Ed25519 (`pith-v1-2026-05`) · public key
Schema	pith-number/v1.0

Canonical hash

91c4df7bf127276ea882069ecc2fe56c7fc842f38e2996e57fbfebc3d36e7121

Aliases

arxiv: 2604.17860 · arxiv_version: 2604.17860v2 · doi: 10.48550/arxiv.2604.17860 · pith_short_12: SHCN667RE4TW · pith_short_16: SHCN667RE4TW5KEC · pith_short_8: SHCN667R

Agent API

Resolver JSON Graph JSON Events JSON Schema Signing key

Verify this Pith Number yourself

curl -sH 'Accept: application/ld+json' https://pith.science/pith/SHCN667RE4TW5KECA2PMYL7FNR \
  | jq -c '.canonical_record' \
  | python3 -c "import sys,json,hashlib; b=json.dumps(json.loads(sys.stdin.read()), sort_keys=True, separators=(',',':'), ensure_ascii=False).encode(); print(hashlib.sha256(b).hexdigest())"
# expect: 91c4df7bf127276ea882069ecc2fe56c7fc842f38e2996e57fbfebc3d36e7121

Canonical record JSON

{
  "metadata": {
    "abstract_canon_sha256": "7cf74a98c967aa3f1dc3d066f9c6385fbab062b6de8a109dc5e8b6f96e136294",
    "cross_cats_sorted": [],
    "license": "http://arxiv.org/licenses/nonexclusive-distrib/1.0/",
    "primary_cat": "cs.CR",
    "submitted_at": "2026-04-20T06:12:51Z",
    "title_canon_sha256": "318a2e430d0e48c10e9fd7170975a1d091df76e240fce759f5f6fd17a7694a3f"
  },
  "schema_version": "1.0",
  "source": {
    "id": "2604.17860",
    "kind": "arxiv",
    "version": 2
  }
}