Submit finding

All systems

Tencent Xuanwu Lab / XlabAI Team Platform

Atuin Automated Vulnerability Discovery Engine

Tencent Xuanwu Lab's LLM-based discovery engine, with direct public credits across cryptography, Vault, PostgreSQL, Windows, Linux, and FreeBSD.

5
Indexed entries
9
CVE IDs tracked
5
Critical/high entries
88%
Evidence index

What it is

Atuin is an automated vulnerability discovery engine from Tencent Xuanwu Lab. Tencent’s public write-up describes Atuin as based on large language model technology and says it has found vulnerabilities across important open-source software.

What is verified

The current Bugflation ledger counts nine public CVEs where Atuin is named by project, vendor, Linux CNA, or advisory records:

The Atuin gnark write-up also describes CVE-2025-57801, but that item is not included in the initial Bugflation Atuin count until the final public advisory chain is reviewed in the same pass.

Why it matters

Atuin broadens the ledger beyond US frontier-model labs and security startups. The public evidence shows an LLM-based vulnerability discovery engine earning credits from major infrastructure projects and cryptographic libraries.

Sources

Attributed findings

Catalogued entries credited to Atuin Automated Vulnerability Discovery Engine.

ID Title System Evidence date Severity
CVE-2026-43760 Apple credits Atuin and BynarIO on a Screen Sharing access-control CVE Screen Sharing access-control weakness - direct Atuin Automated Vulnerability Discovery Engine (direct) + BynarIO AI (direct) Jul 27, 2026 high CVE-2026-49420 Atuin and AISLE converge on FreeBSD libalias stack overflow Remotely reachable stack buffer overflow - direct Atuin Automated Vulnerability Discovery Engine (direct) + AISLE (self-reported) Jun 30, 2026 high CVE-2026-23967, CVE-2026-5807, CVE-2026-6475 Atuin public CVE-backed cluster spans sm-crypto, Vault, and PostgreSQL Cryptographic signature malleability, denial of service, and symlink following - direct Atuin Automated Vulnerability Discovery Engine (direct) May 14, 2026 high CVE-2026-26168 Microsoft credits Atuin on Windows AFD Winsock elevation of privilege Kernel elevation of privilege - direct Atuin Automated Vulnerability Discovery Engine (direct) Apr 14, 2026 high CVE-2025-40345, CVE-2025-68352, CVE-2025-68797 Linux records three CVEs discovered by Atuin Heap corruption, out-of-bounds access, and NULL dereference - direct Atuin Automated Vulnerability Discovery Engine (direct) Jan 13, 2026 high