> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/continuous-vulnerability-elimination-factory-cvef/frontier-model-scanner.md). # Frontier Model Scanner Frontier Model Scanner is an opt-in LLM-based vulnerability scanner. It detects vulnerabilities not yet catalogued in public vulnerability databases. The scanner detects CWE-class risks in first-party and open-source code. It validates exploitability in an isolated sandbox. For confirmed findings, it generates a patch and opens a pull request. Each confirmed vulnerability receives a private Lineaje Vulnerability Enumeration (`LVE`) identifier. ## Why It Matters Signature-based scanners can only match what's already catalogued. Frontier Model Scanner is built for the gap that leaves open: * AI-generated code is expanding the attack surface faster than public CVE databases can track it. Disclosed CVEs are up 20.6% year over year, approaching 59,000 this year. * Mean time-to-exploit has fallen from 2.3 years in 2018 to under 24 hours today. * Across assessed projects, Frontier Defense finds novel vulnerabilities in 100% of them — an average of 5.47 LVEs per project. Roughly 48% are exploitable and 47% are reachable at runtime. * 76% of exploitable findings receive a verified, deployment-ready fix. * Standards bodies are moving toward 12–72 hour remediation windows for critical systems — inside the reach of manual triage. ## Scope and Requirements Frontier Model Scanner is part of the [Continuous Vulnerability Elimination Factory (CVEF)](/continuous-vulnerability-elimination-factory-cvef.md). It supports Frontier Defense workflows for zero-day and first-party risk. Use this scanner with the OSS Scanner included in SBOM360 coverage: * **OSS Scanner** detects known vulnerabilities in open-source dependencies. * **Frontier Model Scanner** detects novel vulnerabilities in first-party and open-source code. The scanner uses your selected LLM provider. A Model Selector lets you mix commercial and open-source frontier models across different repos — supported options include Claude Opus, Claude Fable, Claude Mythos, AWS, Google, Microsoft MDASH, and LLaMA. Your organization must supply an API key. Your LLM provider bills all scan usage directly. Lineaje does not proxy or subsidize those costs. ## Scan Workflow The scanner runs an Agentic Vulnerability Harness in isolated, gVisor-based sandboxes. The workflow has three phases. ### 1. Scan The scanner retrieves the source repository. It uses threat modeling, AST analysis, and call-graph analysis to identify code hotspots. It then evaluates those hotspots for vulnerabilities and weaknesses. ### 2. Judge The scanner evaluates each candidate for false positives, reachability, and severity. It generates an exploit and runs it in a single-use sandbox. A finding proceeds only when the exploit confirms a real, reachable vulnerability. ### 3. Patch For confirmed findings, the scanner generates a compatible patch. It reruns the exploit against patched code. The patch is confirmed when the exploit no longer succeeds. ## Finding output Each confirmed finding includes: * **Overview:** Description, impact, and attack path. * **Find Details:** Detection location and exploit evidence. * **Fix Details:** Proposed code change and validation result. The scanner assigns each confirmed finding an `LVE` identifier. Findings remain private to your tenant. Lineaje does not share or disclose them. You may correlate a finding with a public CVE or follow your own disclosure process. ## Disclosure and Lifecycle Tracking Mission Control maintains centralized, immutable lifecycle tracking for every novel vulnerability, verified exploit, generated patch, and PR status across frontier-model runs — covering exploitable findings, critical non-exploitable findings, false positives, and remediation progress in one place. * Immutable evidence repositories for vulnerabilities, exploits, and patches, held in a private local instance. * Built-in support for VEX and CSAF disclosure formats. * Supports disclosure, sharing, and mitigation workflows through Lineaje SBOM Manager. ## Deployment Options Frontier Model Scanner deploys across Lineaje SaaS, customer cloud, on-premises, or hybrid environments. In hybrid mode, code and scan execution stay entirely inside the customer environment — only findings metadata is sent to the SaaS control plane, meeting data residency and sovereignty requirements. ## Next steps Configure Frontier Model Scanner before running your first scan. See [Configuration](/continuous-vulnerability-elimination-factory-cvef/frontier-defense/configuration.md). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veedna.com/continuous-vulnerability-elimination-factory-cvef/frontier-model-scanner.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.