The paper: https://arxiv.org/pdf/2511.21990

Would be interesting to see this from a pentester’s perspective. But it sounds pretty annoying to find flaws that only occur in a small percentage of cases - and need very long time to run (compared to e.g. SQL injection attacks).