Presented at
DEF CON 33 (2025),
Aug. 8, 2025, 5 p.m.
(45 minutes).
"Fuzzing" is an automated software testing technique essential for detecting security vulnerabilities, effectively identifying over 100,000 bugs across the industry.
While fuzzing has proven effective in uncovering critical issues, software teams often face challenges when implementing the fuzzing process. Teams must spend significant time identifying targets for fuzzing and creating test harnesses with initial inputs. Finally, engineering teams must analyze and fix issues detected by fuzzing.
We created an automated fuzzing solution that leverages LLMs for the codebase analysis to identify optimal fuzzing targets, generating precise fuzzing test harnesses and initial seed inputs.
Our solution automates the reproduction of bugs discovered during fuzzing and generates patches for the affected code.
We achieved significant improvements across all targeted areas, demonstrating the effectiveness of integrating LLMs and automatic code analysis into the fuzzing process.
References:
1. Google published some work on the smart harness generation with LLMs - [link](https://security.googleblog.com/2023/08/ai-powered-fuzzing-breaking-bug-hunting.html)
2. Google published work on identifying fuzzing targets (without LLMs) - [link](https://github.com/ossf/fuzz-introspector)
Presenters:
-
Max Bazalii
Max Bazalii is a Principal Engineer on the NVIDIA DriveOS Offensive Security team, where he leads AI automation projects focusing on software security and formal verification. Prior to joining NVIDIA, he specialized in the security research of mobile operating systems. He has authored numerous publications and delivered technical presentations on jailbreaking Apple platforms, including the first public jailbreak of the Apple Watch. He also served as a lead security researcher on the Trident exploits during the first Pegasus iOS spyware incident. Max holds a Ph.D. in Computer Science, with a focus on software security.
-
Marius Fleischer
Marius Fleischer is a security engineer at the NVIDIA DriveOS offensive security team. He is passionate about applying advancements in AI to tackle security challenges and has a deep interest in low-level software. Previously, Marius worked at the Security Lab of UC Santa Barbara, where he contributed to advancing the state-of-the-art in automated vulnerability detection for operating system kernels.
Similar Presentations: