Coverage-Guided Multi-Agent Harness Generation for Java Library Fuzzing

2026-03-09

AI Summary

This work addresses the challenge of manually crafting Java library fuzzing drivers, which is time-consuming and requires deep understanding of API semantics. To overcome this, the authors propose an automated driver generation approach based on multi-agent collaboration. The method employs five large language model agents built upon the ReAct framework, working in concert to perform API exploration, driver synthesis, compilation repair, coverage analysis, and optimization. It introduces a method-level target coverage mechanism and an agent-guided termination strategy to precisely focus on critical behaviors. This is the first application of a multi-agent architecture to Java fuzz driver generation, integrating call graph analysis with dynamic fuzzing. Evaluated on six widely used Java libraries, the approach improves coverage over the OSS-Fuzz baseline by 26% on average—outperforming Jazzer AutoFuzz by 5%—at a cost of approximately $3.20 and 10 minutes per driver, and discovers three previously unknown vulnerabilities within 12 hours.

Technology Category

• Natural Language Processing: Code Generation / Program Synthesis from Natural Language
• Cognitive Modeling & Cognitive Systems: Agent Architectures
• Search and Optimization: Sampling/Simulation-based Search

Application Category

• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Search and Retrieval-Augmented AI: Agentic search
• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs

Abstract

Coverage-guided fuzzing has proven effective for software testing, but targeting library code requires specialized fuzz harnesses that translate fuzzer-generated inputs into valid API invocations. Manual harness creation is time-consuming and requires deep understanding of API semantics, initialization sequences, and exception handling contracts. We present a multi-agent architecture that automates fuzz harness generation for Java libraries through specialized LLM-powered agents. Five ReAct agents decompose the workflow into research, synthesis, compilation repair, coverage analysis, and refinement. Rather than preprocessing entire codebases, agents query documentation, source code, and callgraph information on demand through the Model Context Protocol, maintaining focused context while exploring complex dependencies. To enable effective refinement, we introduce method-targeted coverage that tracks coverage only during target method execution to isolate target behavior, and agent-guided termination that examines uncovered source code to distinguish productive refinement opportunities from diminishing returns. We evaluated our approach on seven target methods from six widely-deployed Java libraries totaling 115,000+ Maven dependents. Our generated harnesses achieve a median 26\% improvement over OSS-Fuzz baselines and outperform Jazzer AutoFuzz by 5\% in package-scope coverage. Generation costs average \$3.20 and 10 minutes per harness, making the approach practical for continuous fuzzing workflows. During a 12-hour fuzzing campaign, our generated harnesses discovered 3 bugs in projects that are already integrated into OSS-Fuzz, demonstrating the effectiveness of the generated harnesses.

Problem

• fuzz harness generation
• Java library
• coverage-guided fuzzing
• API testing
• automated testing

Innovation

• multi-agent architecture
• coverage-guided fuzzing
• method-targeted coverage
• Model Context Protocol
• fuzz harness generation