Evidence at a glance
Based on the linked sources. The author's reported result and independent confirmation are separate checks.
- AI involvement
- Reported models: LLM (Advocate/Critic Tribunal). Tools: Ghidra, SARIF, CycloneDX, ruff, pyright, pytest. The writeup below describes the work attributed to AI.
- Reported result
- Research. This is the directory's source-based outcome classification.
- Independent confirmation
- Not reported.
- Human work and limitations
- The platform distinguishes between metadata-only RAG seeding and actual exploit execution, enforcing strict gates for weaponization. Development is tracked through specific phases (0-3) with rigorous testing requirements, including linting, type checking, and CI validation.
Original sources
What was done
SCOUT is a firmware analysis platform that uses a hybrid engine to audit ELF binaries and shell scripts, employing an LLM-based tribunal to reduce false positives and generate evidence-anchored exploitability chains for internal red-team use.
SCOUT is an AEG-first firmware analysis platform designed to transform firmware blobs into evidence-anchored exploitability chains and audit-ready dossiers. The platform features a Hybrid Analysis Engine capable of auditing both ELF binaries and shell scripts. A core component of its triage pipeline is an LLM-based tribunal, which utilizes an Advocate/Critic debate model to reduce false positives by 99.3% on historical Tier-2 benchmarks. The platform supports controlled weaponization by promoting verified Proof-of-Vulnerability (PoV) evidence into private, scope-bound exploit packages without publishing raw public payloads. SCOUT integrates an Exploit Pattern RAG that uses metadata-only imports from GitHub and NVD sources to seed hypotheses, explicitly rejecting the cloning or execution of public PoC repositories to maintain safety boundaries. Recent development has focused on Phase 3 AEG Plan IR readiness, with implementation gates and tests required to prove contract compliance. The author notes that broad firmware pass-rate generalizations should not be claimed from current readiness artifacts, as ongoing work includes Phase 1 scale-out and Phase 4 corpus expansion. See SCOUT README for full documentation.
Reproduce it
./scout analyze firmware.bin