{"data":{"id":"d3a4a886-0805-44e2-861f-c9149178f092","title":"Where Do the Tokens Go? Understanding and Reducing Costs in LLM Agents for Vulnerability Discovery","summary":"Researchers studied 200 CyberGym traces from four LLM agents (Codex, OpenCode, Cybench, and EnIGMA) to find where tokens go during vulnerability discovery without producing a working proof of concept. Code localization and understanding, plus vulnerability reasoning and trigger design, account for 60.4% of tokens and are the leading bottlenecks in failed runs. The authors then present AVRI, an interface built around a persistent Bidirectional Evidence Trace, which cuts total cost by 18.0% for Codex and 23.7% for OpenCode on 20 tasks while preserving success rates.","solution":"AVRI, an Agent-centric Vulnerability Reasoning Interface built around a persistent Bidirectional Evidence Trace (BET), with reading, analysis, and persistence commands that let agents build and reuse evidence.","labels":["research","security"],"sourceUrl":"https://arxiv.org/abs/2610.11602v1","publishedAt":"2026-10-08T09:47:18.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":[],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Codex","OpenCode","Cybench","EnIGMA"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-08T09:47:18.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":null,"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":"preprint","atlasIds":null}}