The practical insight behind this reference harness is that LLMs can be scaled to parallelize discovery, but the real engineering bottleneck is verification, triage, and safe patching. Rather than a finished product, this repo codifies a repeatable defender loop—recon → find → verify → dedupe → report → patch—designed so teams can prototype autonomous vulnerability discovery while keeping high-assurance checks in the loop.
What Sets It Apart
- Multi-stage, agentized loop tuned for lower false positives: find agents craft inputs and reproduce crashes under ASAN; independent grader agents verify PoCs; judge/dedupe agents collapse duplicates; report agents produce structured exploitability analysis. This separation raises verification cost for false positives while preserving parallel discovery.
- Built-in safety posture for autonomous runs: the pipeline is designed to run each agent inside gVisor/Docker containers with egress restricted to the Claude API. Autonomous pipelines refuse to run outside the sandbox unless explicitly overridden, acknowledging that verified exploitation requires executing target code.
- Pragmatic, customizable reference implementation: out of the box it targets C/C++ memory bugs, but the harness is modular—signals, PoC formats, build/run steps, and detectors can be swapped to port to other languages or vuln classes.
Who It's For and Tradeoffs
- Great fit if your security team wants a hands-on reference for automating scanning and can invest in sandbox infrastructure and human review for triage/patching. It speeds up discovery and gives reproducible PoCs and candidate patches, enabling iterative scanning waves.
- Look elsewhere if you need a maintained, production SaaS or an off-the-shelf scanner with commercial SLAs. This repo is explicitly a reference (not maintained or accepting contributions) and assumes teams will customize and operate the harness themselves. Autonomous patching and triage remain demanding human tasks—the tool lowers mechanical effort but does not eliminate expert judgment.
Where It Fits
- Use it to prototype autonomous defensive workflows, validate the approach on canary targets, and then either operationalize a tuned internal pipeline or adopt a managed product. Because it emphasizes verified, execution-based findings, it pairs well with teams that already run containerized builds and can host gVisor-isolated agents.
Overall, the repo is most valuable as a reproducible blueprint for connecting LLM-driven analysis to sandboxed execution, verification, and candidate fix generation—not as a drop-in scanner for every codebase without customization.
