---
source: https://info.defcon.org/defcon34/content/66492
created: 2026-08-08T14:46:00
github: https://github.com/n0n4m3x41/weaponAIzer
---
- [Andrea Brosio](https://info.defcon.org/defcon34/people/68694 "Andrea Brosio")
- [Arun Nair](https://info.defcon.org/defcon34/people/67223 "Arun Nair")

## Overview

Most agentic exploit pipelines stall when there's no public PoC — they search, find nothing, and spin. This talk demos a multi-agent system that exploits n-days from scratch in under an hour, even with zero public exploit code available. Given only a CVE ID, the pipeline autonomously: fetches vulnerability details and the upstream fix commit; spins up a pinned Docker lab running the exact vulnerable version; diffs the patch to identify the exploitable code path; generates vulnerability-class-specific attack guidance (not a generic checklist); and runs iterative exploit + validation loops until RCE is confirmed. Demonstrated live against four CVSS 9.8–10.0 vulnerabilities — Apache OpenMeetings deserialization, n8n unauthenticated RCE, Langflow exec() injection, and Spring AI SpEL injection — with working exploits produced in minutes. Every run also outputs a containerized lab and defense report, making it equally useful for detection engineering and patch validation.

## Notes

### Brief
- AI tools have collapsed the disclosure-to-active-exploitation timeline
	- 2018: 2 years → 2026: 10 hours
	- Palo Alto research notes 82%
- AI guardrails
	- Will refuse to build an exploit outright
	- Get around it by breaking the problem up into smaller steps

### Pipeline Design Principles
1. Specialization — each agent is dedicated to a focused stage
2. Minimal context — pass only what that stage needs, less noise
3. Parallelism — independent stages run concurrently
4. Reproducibility — deterministic by design, same input and execution, auditable output

### weaponAIzer
- Requirements
	- An existing CVE
	- LangGraph
- Recommend routing output to human review
	- Also want to evaluate speed vs. cost tradeoffs
- Can be extended to Windows patch and CI/CD pipeline security gating
- 14 specialized agents total, with up to 10 participating in a given workflow run:
	- Research — fetches vulnerability details, identifies the vulnerable operation, builds a vulnerability chain
	- Build and compliance stage — spins up a Docker environment and reproduces the issue
	- Git diff — fetches the vulnerable commit, reads the vulnerable code and the fixed code, compares the two versions
	- Red/Blue stage — distills the raw research report and git diff into prompts for the Red Team agent and the Blue Team agent
	- LLM as judge — reads the evidence and decides, independently of the agent that ran the exploit, whether it actually succeeded
- From the repo: two exploit-validation workflows are available — a legacy path (parallel exploit/defense agents with retry logic) and a LangGraph typed subgraph (Red Team planning → Blue Team review gate → policy approval → deterministic execution → Judge validation) that adds chain-level validation to confirm the exploit actually exercises the CVE's vulnerable code path, not just any RCE
- Stack: Claude Agent SDK for the agent runtime, LangGraph + SQLite checkpoints for orchestration (auto-resumes from checkpoint on re-run), Docker/Docker Compose for the lab, Python 3.12+

### Proof of Concept: CVE-2026-22738
https://github.com/n0n4m3x41/CVE-2026-22738-POC
- Tooling was tested using Claude, but any model can be substituted in