Mission (Im)Possible: Towards Autonomous Discovery of Autopilot Logic Flaws in Open-Source Drone Frameworks

Autonomous drones are increasingly deployed in safety-critical tasks, yet their autopilot software can still contain subtle logic flaws that lead to unsafe behaviors. These flaws are difficult to discover with existing techniques because they often depend on semantic relationships across modules, commands, and runtime state, and may not manifest as crashes or other easily detectable failures.

With recent advances in large language models (LLMs), we observe that, when equipped with essential domain knowledge and carefully crafted context, LLMs demonstrate strong capabilities in understanding the high-level semantics of autopilot systems, making them suitable for logic flaw discovery. However, LLMs are limited by their context and can be biased toward vulnerabilities that frequently occur in training data; logic flaws also may not lead to crashes or other obvious behaviors, which means they require higher-level semantic bug oracles.

To bridge the gap, we present Impossible Mission Finder (IMF), a multi-agent system combining static analysis, dynamic execution, and log analysis that supports fully automated identification, testing, and validation of logic flaws in autonomous vehicles. IMF first uses an auditor agent to propose logic-flaw hypotheses based on carefully crafted program slices, then launches tester agents to write and execute test cases for each candidate, and finally spawns a log-analyzer agent to validate the execution log against the flaw hypothesis. This enables IMF to dynamically validate bug oracles case by case, making it suitable for discovering logic flaws that do not have a unified pattern. We evaluated IMF on two widely used open-source autopilot systems, PX4 and ArduPilot, leading to 105 previously unknown logic flaws after manual validation.