GONDAR: sink API knowledge contextualization for Java vulnerability discovery

GONDAR uses sink API knowledge to guide Java vulnerability discovery and finds 4 times as many vulnerabilities as Jazzer on real-world Java benchmarks. It combines CWE scanning with LLM static filtering to locate exploitable sink call sites, then has two agents, exploration and exploitation, collaborate with a coverage-guided fuzzer to synthesize PoCs; an early version has been integrated into OSS-CRS and found one zero-day vulnerability.