Software vulnerabilities remain one of the most persistent threats to modern digital infrastructure. While static application security testing (SAST) tools have long served as the first line of defense, they suffer from high false-positive rates. This article presents TitanCA, a collaborative project between Singapore Management University and GovTech Singapore that orchestrates multiple large language model (LLM)-powered agents into a unified vulnerability discovery pipeline. Applied in open-source software, TitanCA has discovered 203 confirmed zero-day vulnerabilities and yielded 118 CVEs. We describe the four-module architecture, i.e., matching, filtering, inspection, and adaptation, and share key lessons from building and deploying an LLM-based vulnerability discovery solution in practice.

翻译：软件漏洞仍是现代数字基础设施面临的最持久威胁之一。尽管静态应用安全测试（SAST）工具长期充当第一道防线，但其存在误报率过高的问题。本文提出TitanCA——新加坡管理大学与新加坡政府科技局合作的项目，通过将多个大语言模型（LLM）驱动代理编排至统一漏洞发现流水线中。在开源软件中应用时，TitanCA已发现203个已确认的零日漏洞，并获得118个CVE编号。本文阐述其四模块架构（匹配、过滤、检查与适配），并分享在构建与部署基于LLM的漏洞发现实践中总结的关键经验教训。