Why it matters
Trail of Bits describes how Patch the Planet researchers use Codex goal-based runs to audit Rust, curl, zlib, and Keycloak: derive one verifiable outcome per agent from a threat model, separate coverage from bug discovery, and pass candidates through independent validation and human duplicate checks. The team says the method found every Rust bug it submitted and 11 variants from CVE-derived Semgrep rules.
My takeaway: Treat autonomous bug finding as an evidence pipeline, not a prompt trick. Define attacker preconditions and exclusions in a threat model, assign one success condition per run, measure coverage separately, require a safe proof and independent falsification, check upstream duplicates, and keep human reviewers responsible for severity and disclosure.