Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing
Coverage-guided fuzzing has proven effective for software testing, but targeting library code requires specialized fuzz harnesses that translate fuzzer-generated inputs into valid API invocations. Manual harness creation is time-consuming and requires deep understanding of API semantics, initialization sequences, and exception handling contracts. We present a multi-agent architecture that automates fuzz harness generation for Java libraries through specialized LLM-powered agents. Five ReAct agents decompose the workflow into research, synthesis, compilation repair, coverage analysis, and refinement. Rather than preprocessing entire codebases, agents query documentation, source code, and callgraph information on demand through the Model Context Protocol, maintaining focused context while exploring complex dependencies. To enable effective refinement, we introduce method-targeted coverage that tracks coverage only during target method execution to isolate target behavior, and agent-guided termination that examines uncovered source code to distinguish productive refinement opportunities from diminishing returns. We evaluated our approach on seven target methods from six widely-deployed Java libraries totaling 115,000+ Maven dependents. Our generated harnesses achieve a median 26% improvement over OSS-Fuzz baselines and outperform Jazzer AutoFuzz by 5% in package-scope coverage. Generation costs average $3.20 and 10 minutes per harness, making the approach practical for continuous fuzzing workflows. During 12-hour fuzzing campaigns, our generated harnesses discovered 3 unreported bugs in projects that are already integrated into OSS-Fuzz, demonstrating the effectiveness of the generated harnesses.
Sun 12 AprDisplayed time zone: Brasilia, Distrito Federal, Brazil change
11:00 - 12:30 | |||
11:00 20mTalk | Correlation-Guided Fuzz Testing for Aviation GNSS Receiver SBFT | ||
11:20 20mTalk | IPSM-Based Test Case Minimization for Network Protocol Implementations SBFT | ||
11:40 20mTalk | Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing SBFT Nils Loose University of Luebeck, Nico Winkel , Kristoffer Hempel , Felix Mächtle University of Luebeck, Julian Hans , Thomas Eisenbarth University of Lübeck | ||
12:00 20mTalk | Detecting Server-Side Request Forgery (SSRF) Vulnerabilities In REST API Fuzz Testing SBFT Susruthan Seran , Guru Bhandari , Andrea Arcuri Kristiania University College and Oslo Metropolitan University | ||