AI for Security has never been more exciting. Let me present MAPTA, our multi-agent framework that found multiple (now confirmed!) Remote Code Executions (RCE's) in flagship web products of Tier-1 companies. Why the secrecy? We're good boys, letting them cook patched through
Quite simple. An orchestrator, with the right tools, makes the right calls (pun intended).
We've done a CTF evaluation on the fantastic @Xbow benchmark (which we had to fix due to outdated Docker images). Here're our fixes: https://github.com/arthurgerva...
For the real-world evaluation, we didn't have to look far. We went through (only) 10 important open-source repos, and MAPTA made a bang 💣
WAit BuT DoNt U gEt tOO MaNY fALSe pOsItiVes??!11? Well, we don't claim zero FP, but we have a validation agent which actually 🔪 cut down previous FP significantly through concrete execution, yay!
The patched XBOW benchmark, our evaluation results and code are freely available: https://github.com/arthurgerva... Full paper: https://arxiv.org/pdf/2508.208... Now, please, help us. We've got much work to do. Let's fix the security of the web!
@HatforceSec indeed! i’ve been tweeting about this a lot lately—great work. i only skimmed the paper and noticed you used gpt-5 with high reasoning effort. curious if you’re also planning evaluations with models from other labs?
@0x4D31 indeed, we probably should do that too
@HatforceSec Amazing thanks, saving startups from pricing security spend!
@HatforceSec 🔥 this is cool thanks for sharing!! i dm-ed you
@HatforceSec Nice work!
My intermediate level malware analysis course is there. 60% off for the next two weeks. https://malwareanalysis-for-he...
1997: Nmap was first released as a simple port scanner via an article in issue 51 of Phrack magazine which included the source code. That's right - 28 years of Nmap!
The "Malware Analysis – Intermediate Level" training by @struppigel is 60% off right now Knowing the quality of his other content, I’d say this one’s definitely worth checking out https://malwareanalysis-for-he...
‼️ New course from Mandiant Academy: Basic Static and Dynamic Analysis. Learn IOCs, investigation workflows, safe environments and analysis techniques. Start your training today 👉 https://bit.ly/3JxgAqC
