@vxunderground But in a post you made years ago, you encouraged people to learn to write java goop, because there wasn't a lot of java goop and it could be kind of easier to bypass defenses with java goop :)
A Security Researcher Reworked OpenAIโs CDC Prompt โ and Found a $500K RCE for About $25 in Model Usage
I adapted the approach into a generic vulnerability research prompt. The image contains the full version; hereโs the short version.
Good luck hunting. If youโve built your own prompts or harnesses, share them too.
A generic CDC-style vulnerability research harness (short version):
- Run multiple agents in parallel across distinct exploit families.
- Avoid premature convergence. Do not let every agent pursue the same promising path.
- Mark failed or exhausted paths as blocked.
- Regularly launch new hypotheses and explore neglected attack paths.
Independently adversarially validate every concrete finding.
- Have the root agent continuously synthesize results, challenge assumptions, reprioritize work, and redirect agents.
- Do not use git history, changelogs, CVE databases, or patched-version diffs as shortcuts.
- Require the full exploit chain to work in a realistic, commonly deployed configuration and meet the defined starting-privilege โ impact goal.
- When behavior depends on implementation details, inspect the runtime, framework, database, libraries, and dependency source directly.
- Do not stop at the first primitive. Chain validated primitives until the concrete success condition is reached.