Fuzzing with Agents? Generators Are All You Need

Vasudev Vikram, Rohan Padhye. 2026. arXiv.org.

What this paper does with SQLancer

One citation, naming SQLancer as the database-engine counterpart to CSmith for C compilers: a generator producing inputs that are more than syntactically valid. This paper asks whether an AI coding agent can synthesise the domain-specific input generators that generator-based fuzzing relies on, and whether such generators make coverage guidance and mutation unnecessary. Gentoo gives an LLM agent terminal access and the source of the fuzz target, and has it iteratively synthesise and refine a generator. Across seven Java libraries, agent-synthesised generators beat human-written ones on branch coverage in four. Written by claude-opus-5 from the 1 place this paper refers to SQLancer. The quotations below are the paper's own words, stored verbatim when the text was extracted.

How it was classified

uses infrastructure — no

SQLancer is cited, not used; nothing in the mentions describes reusing its code.

extends technique — no

No technique is extended; the citation is background.

compares with — no

No empirical comparison against SQLancer is reported in the mentions.

describes as state of the art — no

The citation does not characterise SQLancer as the state of the art.

SQLancer publications it cites (1)

Bibliography entries that resolved to a SQLancer publication, or to a paper by one of the project's authors. A sentence citing one of these numbers is a reference to SQLancer even when it never writes the name.

#	Entry	Matched as
8	Jinsheng Ba and Manuel Rigger. 2023. Testing database engines via query plan guidance. In (ICSE). IEEE, 2060–2071.	sqlancer publication · QPG

Every place it refers to SQLancer (1)

1 sentence, each stored verbatim from the extracted text with where it was found and how. “Citation marker” means the sentence names no tool at all and was reached through a reference number that resolved to a SQLancer publication.

Id	Sentence	Found by	Where
M1	Tools such as CSmith [ 52,65] for C compilers and SQLancer [ 8] for database engines generate inputs that are not merely syntactically valid but semantically rich by construction: CSmith emits C programs free of undefined behavior, while SQLancer produces queries that satisfy the relational schemas and type rules of...	name background	1 INTRODUCTION page 2

This page is rendered from _data/papers/paper_arxiv_2604_01442.json, extracted from arxiv. 12 pages, 68 references parsed.