This was a pretty awesome read, I liked it a lot!
What I found out during malware analysis is that LLM agents have a couple of quirks that you can solve by:
- optimize for short lived agent workflows
- use symbols as function contracts
- maintain decision and discovery state
- give LLMs CLI linters
- give LLMs access to knowledge bases
The linter part is mindblowing. I built linters that validate HTML or markdown or docx or Go or C files, for example, and they output what kind of structure is expected instead of useless token based errors (e.g. h4 inside h1? Must be h1 > h2 ...).
With linters the output quality of agents is just soo much better.
For program analysis, I'm currently exploring the idea of using an external ebpf daemon that programs can be observed with via a public API (which is the tool for the agent to use). Not sure if it'll do the trick yet, but I think it has lots of potential.
My stuff in case you're interested:
[1] https://github.com/cookiengineer/exocomp