Neo: LLM-Agent Framework Detects Privilege Escalation in Microservices

A team of researchers has created Neo, a framework for program analysis that integrates large language models (LLMs) with traditional program analysis techniques to identify privilege escalation vulnerabilities in polyglot microservice architectures. This framework employs an LLM-driven agent to generate analysis plans in real-time, modify code search methods, and confirm semantics. Neo features code search primitives that facilitate scalable exploration across services and languages. It was tested on 25 open-source microservice systems. This research tackles issues related to privilege and permission management that stem from intricate cross-service interactions and varied codebases.