How I Used an LLM Multi‑Agent Workflow to Discover Over Ten Open‑Source 0‑Days

Motivation

Manual code review dominates open‑source vulnerability research, but AI‑driven workflows can scale analysis of large web projects. Observations of rapid AI progress in security contests motivated the use of large language models (LLMs) as a core discovery tool.

Target Selection

Memory‑type bugs were excluded because public OSS vulnerability‑reward programs require full exploit chains, which are difficult to automate. Black‑box server bounties were set aside due to the risk of AI‑generated payloads crashing target services. The workflow therefore focused on fully public web applications—Nextcloud, Matomo, and Grafana—that can be deployed locally with Docker.

Architecture Design

The pipeline separates vulnerability discovery from false‑positive verification, routing each stage to a model that balances cost and capability.

Layer 1 – Discovery (GLM‑4.7) : Generates candidate bugs using varied prompts.

Layer 2 – Semi‑Filtering (GLM‑5) : Filters obvious false positives with a higher‑performance model.

Layer 3 – Final Validation (Codex 5.3) : Performs thorough verification of surviving candidates.

Validated findings trigger Discord alerts and are uploaded to Notion; each report is manually reproduced to confirm the result.

Prompt Engineering

Early runs produced many false alerts. Three mandatory elements were added to every AI‑generated analysis:

Attacker Condition : Network location, required privileges, and specific input needed for a successful attack.

Server Condition : Prerequisites such as required plugins, default configurations, or OS‑specific triggers.

Security Impact : Description based on confidentiality, integrity, and availability (e.g., data leakage or denial‑of‑service).

Prompts force the model to output each element explicitly, dramatically reducing false‑positive rates. A second prompt iteration added checks against official security documentation to distinguish true bugs from expected behavior.

Results

The workflow excelled at finding IDOR and business‑logic flaws that traditional scanners miss because they lack contextual understanding.

CVE‑2026‑21721 (Grafana Permission‑Escalation)

Grafana’s dashboard permission API ( /api/dashboards/uid/<uid>/permissions) fails to validate the target dashboard’s scope. The internal call ac.EvalPermission checks only the generic dashboards.permissions:read/write action. Consequently, any user with admin rights on a single dashboard can read or write permissions on all dashboards, yielding a CVSS 8.1 privilege‑escalation vulnerability.

Other disclosed 0‑days include CVE‑2025‑66514 (Nextcloud Mail XSS, CVSS 5.4), CVE‑2025‑66558 (Nextcloud two‑factor WebAuthn issue, CVSS 3.1), CVE‑2026‑0994 (protobuf DoS, CVSS 8.2), CVE‑2026‑22922 (Airflow privileged API misuse, CVSS 6.5), plus multiple bounty‑only findings in Nextcloud, Matomo, Grafana, Owncloud, and Discourse.

Future Outlook

AI‑driven vulnerability hunting is expected to shift routine red‑team discovery tasks toward automated diagnostics embedded in development pipelines, while human expertise will focus on remediation strategy, security architecture, and policy design.