YATA: AN EXPLOIT-VERIFIED MULTI-AGENT FRAMEWORK FOR AUTONOMOUS DETECTION AND REPAIR OF WEB APPLICATION VULNERABILITIES

Security scanners are good at raising alarms and poor at proving them: they over-report and under-report, and a human must still reproduce each alert, write a patch and decide the application is safe.Large language models can now draft such patches almost for free, but a confidently written wrong patch is hard to catch, and the same models are increasingly able to exploit real applications, so trusting a model's verdict only moves the risk.This paper presents YATA (Yet Another Threat Antagonist), a multi-agent framework that works backward from evidence: a weakness is reported only after an exploit has actually run against the code, and a patch is kept only after the framework's own offensive engine re-attacks itwith the original payload and with mutated variantsand fails.Six agents (HUNTER, HEALER, VALIDATOR, MUTATOR, LEARNER, REPORTER) cover source code in Python, JavaScript and TypeScript, while a separate engine, RECON, applies the same discipline to live web targets over HTTP.Every model call carries a deterministic fallback, so the system runs fully offline.On nineteen seeded repositories spanning nine vulnerability classes, YATA proved and repaired all twenty planted vulnerabilities and blocked all 71 mutated payloads, with zero model calls.