AgentFlow: Self-Synthesizing Multi-Agent Teams for Zero-Day Discovery

Executive Summary

TL;DR: AgentFlow is a revolutionary framework that treats the "harness"—the way LLM agents are wired together—as a programmable and optimizable entity. By using a Typed Graph DSL and runtime feedback (like code coverage and memory sanitizers), it automatically evolves complex team structures. It doesn't just find bugs; it discovered 10 zero-days in Google Chrome, including two critical sandbox escapes, and hit #1 on the TerminalBench-2 leaderboard.

Background: This work shifts the focus from "prompt engineering" (fixing the agent's words) to "architectural engineering" (fixing the team's structure). It moves beyond static pipelines into self-evolving, specialized agent ecosystems.

Problem & Motivation: The Context Wall and Coarse Feedback

When LLMs tackle massive targets like the Chrome browser (35 million lines of code), they hit two walls:

1. Context Exhaustion: A single agent drowns in the megabytes of coverage and sanitizer data generated during a run.
2. Generic Signals: If a fuzzer doesn't crash, standard benchmarks give a "0" (fail). This binary signal doesn't tell the agent why it failed—did it fail to parse the file, or did it reach the buggy function but miss the specific branch?

Prior works like Meta-Harness only modified prompts, while AFlow used fixed operators. These "narrow-scope" optimizers couldn't discover complex, task-specific topologies required for deep security audits.

Methodology: The Typed Graph DSL

AgentFlow's core innovation is representing the multi-agent system as a formal program $H=(\mathcal{A},\mathcal{G},\Sigma ,\Phi ,\Psi )$.

1. The Power of "Types" in Agent Design

To make search tractable, AgentFlow uses a Type System. Before spending expensive LLM tokens, a validator checks:

• Consistency: Does every variable in an agent's prompt resolve to an actual upstream output?
• Connectivity: Is every agent part of the data flow?
• This "budget guard" rejects ~20% of malformed proposals for free.

2. Feedback-Driven Optimization

Instead of just "Pass/Fail," AgentFlow feeds the Diagnoser with:

• Coverage Maps: "You missed the color conversion logic."
• Sanitizer Reports: "You caused a minor leak, try to turn it into a Use-After-Free."
• Stderr: "The parser rejected your input at line 40."

Figure 1: The iterative evolution of a harness for CVE-2020-23109, moving from a single agent to a 3-agent team with specific feedback loops.

Experiments & Results

TerminalBench-2 Dominance

AgentFlow achieved a 84.3% pass rate on TerminalBench-2 using Claude Opus 4.6. The synthesis trajectory showed three distinct phases:

1. Infrastructure Initialization: Fixing tool bindings.
2. Role Specialization: Adding "Analyst" and "Explorer" roles.
3. Ensemble Scaling: Implementing fan-out/parallel workspaces.

The Chrome Zero-Day Campaign

Using a mid-tier model (Kimi K2.5), AgentFlow demonstrated that a superior harness design can compensate for raw model power. It discovered 10 zero-days in Chrome.

Figure 2: The complex 18-role harness synthesized for the Chrome campaign, featuring 192 parallel explorers.

Critical Analysis & Conclusion

Takeaway

AgentFlow proves that Harness Design > Prompt Design. By treating the agent topology as a searchable graph constrained by software engineering principles (types, runtime feedback), we can automate the most complex human task in security: specialized team orchestration.

Limitations

• Resource Intensity: The Chrome campaign used 192 H100 GPUs for 7 days. While efficient compared to human hours, the compute cost is non-trivial.
• Static Topologies: While it can search for a topology, once the "best" one is chosen, it remains static during execution. Future work could involve dynamic runtime branching where agents spawn sub-agents on the fly.

Future Outlook

The move toward "Agentic Software Engineering" will likely adopt AgentFlow’s DSL approach. We should expect similar "Self-Synthesizing" architectures to appear in adjacent fields like automated chip design (EDA) and drug discovery.