# AI Pipeline for N-days Weaponization

- URL: https://bryancowan.com/ai-pipeline-for-n-days-weaponization/
- Published: August 12, 2026
- Series: Conference notes
- Tags: defcon34
- Part of: [DEF CON 34 Notes: 15 Talks on AI Security, Agentic Systems, and Red Teaming](https://bryancowan.com/def-con-34-notes-15-talks-on-ai-security-agentic-systems-and-red-teaming/)

**Speakers:** [Andrea Brosio](https://info.defcon.org/defcon34/people/68694), [Arun Nair](https://info.defcon.org/defcon34/people/67223) · **Source:** [DEF CON 34 talk page](https://info.defcon.org/defcon34/content/66492) · **GitHub:** [weaponAIzer](https://github.com/n0n4m3x41/weaponAIzer)

📄 [Download this note as Markdown](https://raw.githubusercontent.com/bryancowan/defcon34-notes/main/AI%20Pipeline%20for%20N-days%20Weaponization.md)

## Overview

Most agentic exploit pipelines stall when there's no public PoC — they search, find nothing, and spin. This talk demos a multi-agent system that exploits n-days from scratch in under an hour, even with zero public exploit code available. Given only a CVE ID, the pipeline autonomously fetches vulnerability details and the upstream fix commit, spins up a pinned Docker lab running the exact vulnerable version, diffs the patch to identify the exploitable code path, generates vulnerability-class-specific attack guidance, and runs iterative exploit + validation loops until RCE is confirmed. Demonstrated live against four CVSS 9.8–10.0 vulnerabilities — Apache OpenMeetings deserialization, n8n unauthenticated RCE, Langflow exec() injection, and Spring AI SpEL injection — with working exploits produced in minutes.

## Notes

### Brief
- AI tools have collapsed the disclosure-to-active-exploitation timeline: 2018's ~2 years down to 2026's ~10 hours (Palo Alto research notes 82%)
- AI guardrails will refuse to build an exploit outright — get around it by breaking the problem up into smaller steps

### Pipeline Design Principles
1. Specialization — each agent is dedicated to a focused stage
2. Minimal context — pass only what that stage needs, less noise
3. Parallelism — independent stages run concurrently
4. Reproducibility — deterministic by design, same input and execution, auditable output

### weaponAIzer
14 specialized agents total, with up to 10 participating in a given workflow run:
- **Research** — fetches vulnerability details, identifies the vulnerable operation, builds a vulnerability chain
- **Build and compliance** — spins up a Docker environment and reproduces the issue
- **Git diff** — fetches the vulnerable commit, reads vulnerable and fixed code, compares versions
- **Red/Blue** — distills the raw research report and git diff into prompts for the Red Team and Blue Team agents
- **LLM as judge** — reads the evidence and decides, independently of the agent that ran the exploit, whether it actually succeeded

Two exploit-validation workflows are available: a legacy path (parallel exploit/defense agents with retry logic) and a LangGraph typed subgraph (Red Team planning → Blue Team review gate → policy approval → deterministic execution → Judge validation) that adds chain-level validation to confirm the exploit actually exercises the CVE's vulnerable code path, not just any RCE.

Stack: Claude Agent SDK for the agent runtime, LangGraph + SQLite checkpoints for orchestration (auto-resumes from checkpoint on re-run), Docker/Docker Compose for the lab, Python 3.12+. Requires only an existing CVE and LangGraph. Can be extended to Windows patch and CI/CD pipeline security gating.

### Proof of Concept: CVE-2026-22738
[github.com/n0n4m3x41/CVE-2026-22738-POC](https://github.com/n0n4m3x41/CVE-2026-22738-POC) — tooling was tested using Claude, but any model can be substituted in.

_Filed Under:_ #defcon34