Notifications
Clear all
Topic starter
02/08/2026 12:00 pm
TL;DR: Researchers combined human pattern finding with autonomous agents to uncover 13 vulnerability categories across Apryse WebViewer and Foxit PDF services, including critical DOM XSS, stored XSS, SSRF, and command injection, according to Novee. The real lesson is that AI only becomes operationally useful in vulnerability research when it is constrained by human-led trust-model analysis and verified exploit chains.
NHIMG editorial — based on content published by Novee: From PDF to Pwn, scalable 0day discovery in PDF engines and services using multi-agent LLMs
By the numbers:
- The result was the discovery of 13 distinct vulnerability categories, ranging from critical XSS to OS Command Injection.
Questions worth separating out
A: Treat PDF viewers and converters as application platforms with multiple trust boundaries, not as passive readers.
A: Because attacker-controlled input can cross from a document or URL into rendering logic that the application treats as trusted.
Q: What do security teams get wrong about XSS in complex browser applications?
A: They often focus on payload filtering and miss the real issue, which is trust assignment across components.
Practitioner guidance
- Audit cross-origin configuration channels Inventory every query-string, postMessage, JSON config, and fragment-based input that can alter rendering or execution in browser-delivered applications.
- Block dangerous DOM sinks in code review Treat innerHTML, script creation, DOMParser to HTML transitions, and unsafe SVG handling as review-blocking patterns unless they are paired with robust sanitisation and encoding.
- Separate document metadata from trusted state Keep annotation fields, author names, titles, and document-derived attributes out of privileged rendering paths unless they are strictly encoded and isolated.
What's in the full report
Novee's full article covers the technical detail this post intentionally leaves for the source:
- RCA walkthroughs for each vulnerability category, including the exact sink and source paths in Apryse and Foxit.
- Payload design details showing why standard SVG and postMessage protections failed in the tested code paths.
- Agent workflow notes on how human researchers taught the model to recognise vulnerability patterns and expand coverage.
- Appendix-level findings across 16 named issues, including severity and affected components.
👉 Read Novee’s analysis of multi-agent LLMs for zero-day discovery in PDF engines →
Multi-agent LLMs and PDF engines: what security teams should note?
Explore further
02/08/2026 1:06 pm
Multi-agent LLMs are becoming a force multiplier for exploit discovery, not a replacement for security judgment. The research shows that human analysts still need to identify the vulnerable pattern, the relevant trust boundary, and the exploit shape before the agent can search at scale. That makes agentic research useful for coverage, but only where the underlying reasoning has been disciplined by human expertise. Practitioners should expect better discovery throughput, not automated certainty.
A few things that frame the scale:
- The result was the discovery of 13 distinct vulnerability categories, ranging from critical XSS to OS Command Injection, according to LLMjacking.
- The same research found that attackers attempted access to publicly exposed AWS credentials within an average of 17 minutes, showing how quickly secret exposure can turn into abuse.
A question worth separating out:
A: Separate the layers in your risk model and test each one independently. The browser UI needs origin validation and sink review. The parsing engine needs fuzzing and parser hardening. The backend conversion service needs SSRF controls, network segmentation, and strict egress policy. One control set cannot protect all three layers.
👉 Read our full editorial: Multi-agent LLMs are scaling PDF engine zero-day discovery
