LLM-based agents can autonomously identify and exploit vulnerabilities in post-quantum cryptographic implementations (e.g., ML-KEM-768 side-channel leaks) by dynamically chaining static analysis, fuzzing, and entropy validation tools, outperforming traditional rule-based audits.

An LLM-based autonomous agent system (orchestrating an LLM planner/controller with static analysis tools, fuzzers, and statistical entropy/timing validators as callable functions) can, without human-authored exploit logic, discover at least one previously unpublished or independently-reproduced side-channel vulnerability (timing, cache, power-model-proxy, or decryption-failure-oracle leak) in a reference or production ML-KEM-768 implementation, within a fixed compute/time budget, at a true-positive detection rate and false-positive rate that are statistically superior (p<0.05, paired comparison on identical codebase versions) to a matched rule-based/static-audit baseline (e.g., CodeQL + ConstantTime lint rules + Valgrind ctgrind) run on the same target and budget.

Controlled comparative study, within-subject design across matched codebases:

1. Select N=5 ML-KEM-768 implementation variants: (a) PQClean reference C, (b) PQClean optimized/AVX2, (c) liboqs, (d) one deliberately bug-injected variant (mutation testing: insert known leak pattern, e.g., secret-dependent branch in poly_frommsg or non-constant-time cmov), (e) one variant with no known leaks (negative control, formally verified subset if available, e.g., HACL* / Fiat-Crypto derived).
2. Run agent pipeline and baseline pipeline independently on each variant, 30 trials each (varying agent temperature/seed) to estimate variance.
3. Score both against a ground-truth vulnerability oracle: a manually curated, human-expert-verified list of known CVEs/leaks + the injected bug in (d) + confirmed absence in (e).
4. Blind human reviewers score agent/baseline output reports for precision (is flagged leak real and exploitable) without knowing source.
5. Statistical test (McNemar's test or paired bootstrap) on detection outcomes; report effect size.

class SideChannelAgent:
    tools = [StaticAnalyzer(codeql), Fuzzer(afl++), 
             TimingHarness(dudect, perf_rdtsc), 
             ConstantTimeChecker(ctgrind), 
             PatchProposer(), ReportWriter()]

    def run(target_repo, budget_calls=50, budget_hours=2):
        state = load_codebase(target_repo)
        plan = LLM.generate_initial_plan(state.file_tree, prior_findings=[])
        findings = []
        for step in range(budget_calls):
            if time_exceeded(budget_hours): break
            action = LLM.decide_next_tool(state, plan, findings)
            result = execute_tool(action.tool, action.args)
            state = update_state(state, result)
            if result.is_candidate_leak:
                confidence = LLM.assess_confidence(result, cross_check=[
                    ConstantTimeChecker.verify(result.location),
                    TimingHarness.dudect_test(result.location, n_traces=1e6)
                ])
                if confidence > threshold:
                    findings.append(build_finding(result, confidence))
            plan = LLM.replan(state, findings)
        return generate_report(findings)

# Baseline (non-agentic, fixed pipeline):
def rule_based_audit(target_repo):
    static_hits = CodeQL.run(target_repo, ruleset='constant-time')
    fuzz_hits = AFLPlusPlus.run(target_repo, timeout=2*3600)
    timing_hits = dudect.run(target_repo.crypto_functions)
    return merge_and_dedupe([static_hits, fuzz_hits, timing_hits])