Abstract
Software vulnerabilities are a critical threat to global digital infrastructure, with over 30,000 new Common Vulnerabilities and Exposures (CVEs) published in 2024 alone-a 25 % increase from the previous year. Despite advancements in automation, current security code review tools, including AI-powered systems, remain fundamentally reactive. They are limited to identifying known vulnerability patterns and struggle with novel attack vectors, complex logic flaws, and multi-step exploits, which constitute a significant portion of critical security breaches. We propose Nemesis, a paradigm shift from detection to proactive adversarial simulation. Nemesis is a multi-agent AI framework where specialized Large Language Model (LLM)-based agents engage in a dynamic, iterative “capture the flag” exercise within a codebase. The Red Team Agent performs semantic code analysis to invent context-aware, novel exploit chains. The Blue Team Agent defends by validating these exploits and synthesizing robust patches. A Judge Agent orchestrates this adversarial dialogue. Evaluated on a dataset of open-source applications, Nemesis demonstrated a higher Novel Finding Rate (NFR) than traditional SAST tools and an improvement in Patch Robustness over monolithic LLM reviewers. This work establishes a new benchmark for proactive, reasoning-based software security hardening.