# SCOUT: SCOUT Firmware Exploitability Platform > Source: > Published: 2026-10-24 09:01:07+00:00 ## Evidence at a glance Based on the linked sources. The author's reported result and independent confirmation are separate checks. - AI involvement - Reported models: LLM (Advocate/Critic Tribunal). Tools: Ghidra, SARIF, CycloneDX, ruff, pyright, pytest. The writeup below describes the work attributed to AI. - Reported result - Research. This is the directory's source-based outcome classification. - Independent confirmation - Not reported. - Human work and limitations - The platform distinguishes between metadata-only RAG seeding and actual exploit execution, enforcing strict gates for weaponization. Development is tracked through specific phases (0-3) with rigorous testing requirements, including linting, type checking, and CI validation. ### Original sources ## What was done SCOUT is a firmware analysis platform that uses a hybrid engine to audit ELF binaries and shell scripts, employing an LLM-based tribunal to reduce false positives and generate evidence-anchored exploitability chains for internal red-team use. SCOUT is an AEG-first firmware analysis platform designed to transform firmware blobs into evidence-anchored exploitability chains and audit-ready dossiers. The platform features a Hybrid Analysis Engine capable of auditing both ELF binaries and shell scripts. A core component of its triage pipeline is an LLM-based tribunal, which utilizes an Advocate/Critic debate model to reduce false positives by 99.3% on historical Tier-2 benchmarks. The platform supports controlled weaponization by promoting verified Proof-of-Vulnerability (PoV) evidence into private, scope-bound exploit packages without publishing raw public payloads. SCOUT integrates an Exploit Pattern RAG that uses metadata-only imports from GitHub and NVD sources to seed hypotheses, explicitly rejecting the cloning or execution of public PoC repositories to maintain safety boundaries. Recent development has focused on Phase 3 AEG Plan IR readiness, with implementation gates and tests required to prove contract compliance. The author notes that broad firmware pass-rate generalizations should not be claimed from current readiness artifacts, as ongoing work includes Phase 1 scale-out and Phase 4 corpus expansion. See [SCOUT README](https://raw.githubusercontent.com/r00t-kim/scout/HEAD/README.md) for full documentation. ## Reproduce it ``` ./scout analyze firmware.bin ```