Ulysses: A Security Harness For Synthesizing Verifiable Web Exploits

Summary

Ulysses is a multi-agent security harness that turns candidate web application vulnerability findings into verified Proofs of Exploitability by testing exploit hypotheses against independently observed execution effects. Evaluated on WebExploitGym, a benchmark of exploitable instances from 25 real-world web applications across 5 languages and 7 frameworks, it produced verified proofs for 10 of 25 real-world advisories and discovered 4 new proofs of exploitability never previously reported.