Code-Augur: agent vulnerability detection through specification inference

The researchers propose Code-Augur, a framework for agent vulnerability detection through security specification inference, and found 22 new vulnerabilities in key open-source projects. When the Agent determines that a component is safe, Code-Augur writes the local invariants supporting that judgment as in-source assertions, while using guided fuzzing to try to falsify these assumptions; when an assertion is triggered, it either exposes a real vulnerability or exposes an incorrect specification that needs correction, thereby aligning the Agent's understanding of code intent with the code's actual behavior. On real projects, Code-Augur detects more vulnerabilities than other state-of-the-art Agents; compared with specialized models such as Claude Mythos, it can implement effective agent vulnerability detection based on widely available LLMs such as Sonnet and DeepSeek.