From Fuzzing to Autonomous Agents: Recent Advances in AI-Assisted Vulnerability Discovery for Web Platforms

This survey paper reviews recent advances in AI-assisted vulnerability discovery for web platforms, focusing on the evolution from traditional coverage-guided fuzzing to large language model (LLM)-assisted testing, tool-using autonomous agents, and automated vulnerability validation and remediation. The paper proposes a verification ladder and a reasoning-autonomy scale to classify existing systems based on their capabilities and the strength of their validation mechanisms. It examines published research and industry deployments involving browser security, JavaScript engines, web application vulnerabilities, and automated program repair. The survey also discusses the limitations of current evaluation methods, the reliability of reported results, false positives, patch validation, and open research challenges. Finally, it outlines directions for developing more reliable, reproducible, and secure AI-assisted vulnerability discovery pipelines.