AgentFlow: Automating Multi-Agent Orchestration for Zero-Day Discovery

Executive Summary

TL;DR: AgentFlow is a revolutionary framework that treats the "harness"—the orchestration logic of LLM agents—as a searchable program. By combining a typed graph DSL with granular runtime feedback (like AddressSanitizer and code coverage), it automatically crafts high-performance multi-agent teams.

Positioning: This work moves beyond "prompt engineering" into "architecture synthesis." It currently holds the #1 spot on the TerminalBench-2 leaderboard and has successfully breached the defensive perimeter of Google Chrome, uncovering 10 zero-day vulnerabilities that human auditors missed.

The Bottleneck: Why One Agent is Not Enough

In the realm of security research, a single LLM agent often collapses under the weight of "voluminous output." A single instrumented Chrome build can emit megabytes of data, far exceeding the 200K token context windows of frontier models. This leads to the "lost-in-the-middle" effect, where models forget their analysis or repeat fruitless strategies.

While splitting work across specialized agents (Analyst, Explorer, Verifier) helps, the Harness Design Problem arises: Who talks to whom? What tools do they use? How do they recover from failure? Historically, these harnesses were hand-written, and previous optimizers (like Meta-Harness or ADAS) were too narrow in scope to find optimal configurations.

Methodology: The Typed Graph DSL

AgentFlow solves the "narrow scope" problem by formalizing a harness $H$ as a five-component tuple: $H=(\mathcal{A},\mathcal{G},\Sigma ,\Phi ,\Psi )$.

• $\mathcal{A}$ (Agents): Roles, prompts, and specific LLM models.
• $\mathcal{G}$ (Graph): The communication topology.
• $\Sigma$ (Schema): What data passes between nodes.
• $\Phi$ (Tools): Tool allocation (e.g., read-only vs. execute).
• $\Psi$ (Protocol): Coordination (parallel fan-out, retries).

Architecture Visualization

Figure 1: The iterative evolution of a harness. Note how the system moves from a single agent to a multi-stage pipeline with feedback loops.

To make searching this massive space tractable, AgentFlow uses a Type System. Before spending expensive GPU tokens on a candidate harness, it performs a structural check:

1. Variable Resolution: Does the prompt reference data that will actually exist?
2. Edge Validity: Do edges connect to agents that actually use the info?
3. Connectivity: Is every agent part of the workflow?

Closing the Loop with Runtime Diagnostics

The "secret sauce" of AgentFlow is its use of rich feedback channels instead of binary pass/fail scores.

• Line/Branch Coverage: Tells the system if its input even reached the buggy function.
• Sanitize Reports (ASan/UBSan): Detects silent memory corruptions that don't cause an immediate crash.
• Stderr/Stdout: Provides diagnostic error strings from the target program.

When a harness fails, the Diagnoser (an LLM) analyzes these signals to pinpoint the "bottleneck agent" and suggests a "corrective edit" (e.g., "The Explorer is stuck on a format check; add a specialist Parser-Analyst").

Experimental Results & Real-World Impact

AgentFlow was validated on two grueling fronts:

1. TerminalBench-2 Mastery

On a suite of 89 long-horizon tasks, AgentFlow reached 84.3%, surpassing all competitors, including specialized production-grade harnesses like ForgeCode. Figure 6: The final synthesized harness for TerminalBench-2, featuring nine roles and three parallel workspaces.

2. Hunting Zero-Days in Chrome

Testing on the 35M+ line Chrome codebase, AgentFlow (using the mid-tier Kimi K2.5 model) discovered ten zero-days.

• CVE-2026-5280 & CVE-2026-6297: Two critical sandbox-escape vulnerabilities.
• This demonstrates that a superior harness can empower a mid-tier model to outperform frontier models with inferior orchestration.

Critical Insight & Future Outlook

Takeaway: AgentFlow proves that the "bottleneck" in AI capability is shifting from the model itself to the System Architecture in which the model resides.

Limitations: The system currently relies on static topologies (no runtime agent spawning). Future work could explore dynamic agents that self-replicate based on task complexity.

Conclusion: By treating the multi-agent harness as a typed, synthesizable program, AgentFlow provides a blueprint for the next generation of autonomous security researchers.