Speakers: Andrea Brosio, Arun Nair · Source: DEF CON 34 talk page · GitHub: weaponAIzer

📄 Download this note as Markdown

Overview

Most agentic exploit pipelines stall when there’s no public PoC — they search, find nothing, and spin. This talk demos a multi-agent system that exploits n-days from scratch in under an hour, even with zero public exploit code available. Given only a CVE ID, the pipeline autonomously fetches vulnerability details and the upstream fix commit, spins up a pinned Docker lab running the exact vulnerable version, diffs the patch to identify the exploitable code path, generates vulnerability-class-specific attack guidance, and runs iterative exploit + validation loops until RCE is confirmed. Demonstrated live against four CVSS 9.8–10.0 vulnerabilities — Apache OpenMeetings deserialization, n8n unauthenticated RCE, Langflow exec() injection, and Spring AI SpEL injection — with working exploits produced in minutes.

Notes

Brief

• AI tools have collapsed the disclosure-to-active-exploitation timeline: 2018’s ~2 years down to 2026’s ~10 hours (Palo Alto research notes 82%)
• AI guardrails will refuse to build an exploit outright — get around it by breaking the problem up into smaller steps

Pipeline Design Principles

1. Specialization — each agent is dedicated to a focused stage
2. Minimal context — pass only what that stage needs, less noise
3. Parallelism — independent stages run concurrently
4. Reproducibility — deterministic by design, same input and execution, auditable output

weaponAIzer

14 specialized agents total, with up to 10 participating in a given workflow run:
– Research — fetches vulnerability details, identifies the vulnerable operation, builds a vulnerability chain
– Build and compliance — spins up a Docker environment and reproduces the issue
– Git diff — fetches the vulnerable commit, reads vulnerable and fixed code, compares versions
– Red/Blue — distills the raw research report and git diff into prompts for the Red Team and Blue Team agents
– LLM as judge — reads the evidence and decides, independently of the agent that ran the exploit, whether it actually succeeded

Two exploit-validation workflows are available: a legacy path (parallel exploit/defense agents with retry logic) and a LangGraph typed subgraph (Red Team planning → Blue Team review gate → policy approval → deterministic execution → Judge validation) that adds chain-level validation to confirm the exploit actually exercises the CVE’s vulnerable code path, not just any RCE.

Stack: Claude Agent SDK for the agent runtime, LangGraph + SQLite checkpoints for orchestration (auto-resumes from checkpoint on re-run), Docker/Docker Compose for the lab, Python 3.12+. Requires only an existing CVE and LangGraph. Can be extended to Windows patch and CI/CD pipeline security gating.

Proof of Concept: CVE-2026-22738

github.com/n0n4m3x41/CVE-2026-22738-POC — tooling was tested using Claude, but any model can be substituted in.

Filed Under: #defcon34