CVE-2026-56412 — Incomplete fix bypass in libexpat, found autonomously by Vorthix

How It Works

Autonomous exploit development meets attacker-reachable confirmation.

Vorthix AI closes the loop between finding and proving. It thinks like an attacker, writes exploits autonomously, executes them end-to-end over the network, and confirms vulnerabilities are attacker-reachable — not speculative, proven.

Talk to Our TeamSee the Proof Engine

What is Vorthix AI?

Vorthix AI is an autonomous security researcher that finds and proves vulnerabilities in source code and compiled binaries. Unlike static analysis scanners that produce false positives, it only reports findings it can reproduce deterministically and confirm as attacker-reachable. It operates in six phases: Ingest & Model (compile with sanitizers), Hypothesize (adversarial reasoning), Write the Exploit (autonomous code generation), Build the Environment (setup attack infrastructure), Execute & Confirm (network-verified exploitability), and Report (minimized reproducer, sanitizer trace, suggested patch, regression test). Zero false positives are shipped by construction — see it in action in the CVE-2026-56412 libexpat writeup.

01 · Ingest

It builds a model of your target the way an attacker would.

Vorthix clones the repository, compiles with AddressSanitizer, UBSan, and coverage instrumentation, and constructs a model of every reachable entry point, sink, and trust boundary across the build. Source or binary.

Phase output

AddressSanitizer
UBSan
Coverage instrumentation
Source + binary

02 · Hypothesize

It reasons about where the code is most likely to break.

The agent prioritizes parsers, decoders, deserializers, and auth paths. It reads patches as claims and finds the paths where the fix’s assumption breaks. It writes targeted harnesses on the fly and drives coverage-guided fuzzing at over a million executions per second.

Phase output

Patch-as-claim analysis
Adversarial prioritization
1M+ exec/sec
Auto-generated harnesses

03 · Exploit & Confirm

Vorthix AI writes the exploit autonomously.

For network vulnerabilities, it provisions an attacker server and a target server, executes the exploit end-to-end over the network, and confirms the vulnerability is attacker-reachable via live network exploitation. For memory corruption, it compiles with AddressSanitizer and confirms deterministic reproduction across repeated runs.

See it proven in CVE-2026-56412: Incomplete Fix Bypass in libexpat.

Phase output

Autonomous exploit generation
Network-confirmed exploitability
End-to-end execution
Deterministic reproduction

04 · Report

It hands you the smallest reproducer and a drafted fix.

The crashing input is minimized to its essential bytes. You receive the sanitizer trace, the root-cause path, a suggested patch, and a regression test that fails before and passes after. The full disclosure package, written autonomously.

Phase output

Minimized reproducer
Sanitizer trace
Suggested patch
Regression test

Continuous by Design

It re-hunts on every commit, not once a quarter.

Wire Vorthix into CI and it re-evaluates the diff against the whole attack surface. New code is hunted immediately; resolved findings are guarded by the regression tests it wrote.

Diff-aware incremental hunts
Native CI/CD integration
Regression guards on every fix
vorthix-agent · XOR-1 · session.log
18:43:40INFOITERATION 42/50
18:43:40INFOCalling XOR-1...
18:48:31INFOXOR-1 responded in 291.2s
18:48:31THINKReading patch PR #1246 as a claim...
18:48:31THINKAssumption: m_handlerCallDepth incremented before every handler
18:48:31PLANMapping all call sites of m_characterDataHandler...
18:55:09THINKGap found: doCdataSection() XML_TOK_DATA_CHARS — no beforeHandler()
19:01:52TOOLCompiling PoC with AddressSanitizer...
19:05:54RESULTheap-use-after-free confirmed at xmlparse.c:4622
19:05:54RESULTCVE-2026-56412 — PROVEN
>

How long does Vorthix take to find a vulnerability?

The pymonocypher heap buffer overflow (GHSA-8f95-v3jq-cj86) was confirmed in 1 hour 50 minutes from initial analysis. The libexpat incomplete fix bypass (CVE-2026-56412) was found in iteration 42 of a 50-iteration session. Initial findings on a standard single-target Focused engagement appear within 24–48 hours. The exact time depends on target complexity, codebase size, and attack surface density.

Vorthix does not stop at the first vulnerability. It continues until the iteration budget is exhausted. On the libexpat engagement, the same session that found CVE-2026-56412 also analyzed multiple other entry points and code paths — a full picture of the attack surface, not a single finding. See the full research index or the incomplete fix detection methodology behind that finding.

Point it at a target. Leave with proof.

Private access open to security teams and researchers.

Get StartedContact the Team