Agentic Planning for Symbolic Execution

2026-07-31

AI Summary

Symbolic execution often struggles to adequately explore program paths due to resource constraints. To address this limitation, this work proposes Agolic, a novel system that introduces agent-based planning into the symbolic execution workflow. Without altering the underlying exploration logic, Agolic dynamically configures multiple rounds of bounded symbolic execution through cross-round, high-level reasoning. The approach synergistically integrates large language models, source code analysis, coverage replay, and goal-directed strategies to substantially enhance path coverage. Experimental results demonstrate that Agolic achieves, on average, more than three times the branch coverage of continuous symbolic execution across several C/C++ programs and uncovers previously unexplored branches in six out of seven benchmarks—branches missed by a combination of fuzzing and compiler-assisted concrete execution.

Abstract

Symbolic execution seeks to explore feasible program paths, yet a practical run may exhaust its resources while much program behaviour remains unreached. We investigate a complementary way of extending its practical reach by reasoning about how the same tool is utilised from one bounded run to the next, while leaving ordinary state exploration to the underlying tool. We present Agolic, an agentic planning system that uses evidence from earlier runs to choose and configure later bounded symbolic execution (BSE) runs, which the underlying symbolic execution tool then carries out. The planning intelligence, available evidence and execution modes can be adapted to the symbolic execution tool and analysis objective. We evaluate one adaptation for branch-coverage exploration, in which an LLM-based agent reasons over source code, replayed coverage and earlier targeting attempts. We evaluate Agolic on several C and C++ programs. On every program, it extends the branch coverage obtained by continuous symbolic execution and covers more than $3\times$ as many branches on average. It also covers more branches than each individual corpus from coverage-guided fuzzing and compiler-based concolic execution in our evaluation and reaches branches absent from all comparison corpora combined on six of the seven programs. Taken together, these results point to considerable untapped potential in existing symbolic execution tools, some of which may be realised by reasoning about how their capabilities are used across runs while leaving state selection during ordinary symbolic exploration to the underlying tool.

Problem

• symbolic execution
• path exploration
• branch coverage
• resource exhaustion
• program analysis

Innovation

• agentic planning
• symbolic execution
• bounded symbolic execution
• branch coverage
• LLM-based reasoning