Mastermind AI Improves Vulnerability Reproduction in Code Repositories.

Reproducing software vulnerabilities at a repository level is a highly complex task for AI agents, requiring them to analyze code, infer input grammars, construct proof-of-concepts (PoCs), and verify fixes. While current LLM agents can often execute these steps, they frequently fail due to selecting an incorrect overall strategy. This paper introduces Mastermind, a novel dual-loop framework designed to address this strategic gap. Mastermind separates the learning of high-level, reusable strategies from task-specific experience. A trainable planner learns robust vulnerability-reproduction strategies through supervised fine-tuning and reinforcement learning, while an experience loop maintains local records to guide subsequent attempts. This architecture allows the planner to improve multiple frozen executors without altering their core action-generation capabilities. Evaluations on the CyberGym benchmark show Mastermind, using GPT-5.5 as an executor, achieved an 84.5% pass rate, significantly outperforming other methods. The same planner also improved the performance of other LLMs, demonstrating that learning and reusing high-level strategies is a highly effective and transferable mechanism for enhancing repository-scale software engineering agents.