Superagent

AI Red teaming (YC W24)

[Superagent @superagent_ai]

Bullish on this team

[Scott Motte @motdotla]

The Superagent team has been a pleasure to work with. They've helped us identify issues, improve dotenvx, and make the project stronger for the open source community. Doing good work!

[Superagent @superagent_ai]

Repo: https://t.co/OD5TZ21x4o

[OpenAI @OpenAI]

Building apps has never been easier.

With Sites, Codex can turn your work, ideas, and plans into an interactive website or app your team can explore, use, and share with a URL.

Rolling out to Business and Enterprise plans, before expanding more broadly.

[Superagent @superagent_ai]

We open-sourced two new security skills today that we have been running in the wild.

[homanp @pelaseyed]

Open sourcing 2 new security skills today:

First, authz-security that finds broken access control (IDOR/BOLA) in your application code

[Superagent @superagent_ai]

https://t.co/KjAhTBE1Ws

[Superagent @superagent_ai]

Today we are open sourcing a set of security skills. They encapsulate everything we learned red-teaming some of the largest open-source projects out there.

Ships with: CI/CD + Skill audits. More to come...

[homanp @pelaseyed]

I just open sourced a collection of skills we've crafted while red-teaming some of the largest open-source projects out there (300M+ downloads per week).

Ships with:

✅ CI/CD best practices (to not get shai-huluded)
✅ Skills security

More skille to come, highly recommend.

[homanp @pelaseyed]

I've been onboarding customers to our private beta the past week, totally changes how they work with contributors, vulnerability and bug reports on Github.

Talking to users is the most fun part of running a business. Especially when you can help out with solving a pain point.

[Superagent @superagent_ai]

Building products that dramatically reduce the time from vulnerability to broad public release is where most value for the eco-system will occur.

This isn't an AI problem, this is a process problem.

[homanp @pelaseyed]

The scary part isn’t always finding the vulnerability.

It’s what happens after the patch exists.

We can apply a private fork patch in ~1 hour.

But disclosure, enterprise notices, and coordinated release can take ~1 month.

That month is where most users remain exposed.

@superagent_ai is working to shrink that gap from months to minutes.

[Superagent @superagent_ai]

Install it!

https://t.co/W7Go4f1uP1

[Superagent @superagent_ai]

Today we are releasing the Superagent Security Bot for Github.

- Vets contributors so you don't merge slop
- Scans PRs for vulns and malicious code
- Enforces security best practices (shai-hulud)
- Works for private and public repos

Open source. Free.

[homanp @pelaseyed]

Introducing the @superagent_ai Security Bot for Github.

✅ Checks that contributors aren't slop
✅ Sancs PR's for vulnerability and malicious code
✅ Enforces security best practices (Shai-Hulud)
✅ Works on private and public repos

Open source and free to use. ⏬

[Alan Zabihi @alanzabihi]

Fun fun fun. Register today!

[Iman Radjavi @imanradjavi]

we have a couple of great talks lined up:

> How To Build a Hacker Agent and Why Offense Is the Best Defense - @alanzabihi, @superagent_ai (YC W24)
> Constant-Time Scheduling, Variable-Time Pain - @OliverStenbom, @endform_dev

two more tba @WeAreLegora, @Quartr_App 👀

join us may 19, sign up below

[Superagent @superagent_ai]

We worked together with the slack maintainers to patch a critical vulnerability in slack bolt node package allowing unauthenticated attackers with network reach to inject arbitrary events, actions, and commands that execute under the app's bot token.

[Superagent @superagent_ai]

@pelaseyed 🙌

[Superagent @superagent_ai]

Unauthenticated DoS in OpenTelemetry JS Prometheus exporter. A single malformed HTTP request to the default metrics port (9464) crashes the host Node.js.

CVSS 7.5 · Patched in 0.217.0

Thanks to the OTel team for the quick fix.

https://t.co/6dGbLDDSAt

[Superagent @superagent_ai]

Last week we collaborated with the OpenTelemetry team to patch vulnerabilities in three of their packages targeting Prometheus exporter.

[Superagent @superagent_ai]

Evolution

[homanp @pelaseyed]

https://t.co/rC0HZcaSrO

[Iman Radjavi @imanradjavi]

On May 19th, we're hosting an engineering night in Stockholm together with our friends at @awscloud and @inceptionfundvc.

The format is short, technical talks from engineers at @WeAreLegora,
@Quartr_App, @specific_dev, @superagent_ai, and a few more. Focus is on actual problems they're working on day to day. Good food and drinks after.

Spots are limited. If you'd like to give a talk yourself, mention it when you apply.

Hope to see you there!

https://t.co/86VjHF71re

[Superagent @superagent_ai]

Offense is the best defense.

[homanp @pelaseyed]

We've disclosed and patched over 100 zero-days in collab with some of the most popular open source projects and packages with millions of downloads a week.

You will hear about them in a couple of weeks when the Socket, Akido etc. pick them up.

Offense is the best defense.

[homanp @pelaseyed]

We've disclosed and patched over 100 zero-days in collab with some of the most popular open source projects and packages with millions of downloads a week.

You will hear about them in a couple of weeks when the Socket, Akido etc. pick them up.

Offense is the best defense.

[homanp @pelaseyed]

https://t.co/IVE3NkdZh8