Attacker-first agents turn vuln triage into repair candidates
A security agent can start from attacker-first exploit-path search and prepare a production-code fix instead of following an abstract checklist.
Capability delta
Before: Security review identifies a vulnerability and hands remediation back to humans. Enabling change: VulnHunter-style agent reasons from attacker behavior to vulnerable code and repair candidates. After: The workflow can move from exploit-oriented analysis to proposed code change faster. Human consequence: Security teams get a more actionable review artifact, but still need human approval before code changes.
Source ledger
Publishable sources attached to this record.
| # | Source | Role | Public status |
|---|---|---|---|
| 1 | medium.comsource | primary receipt | source_urls |
| 2 | github.blogrepo | supporting receipt | source_urls |
| 3 | github.comrepo | supporting receipt | source_urls |
| 4 | x.comsource | supporting receipt | source_urls |
This delta is useful as a project seed: do not publish an autonomous fix, but build a read-only or approval-gated workflow that shows the exploit path, affected code, proposed patch, and evidence.
September 2026 update
Why now
Taskflow fuzzing, security-audit skills, and sandboxed benchmark execution make attacker-first work more plausibly reproducible and reviewable.
Build this as read-only discovery plus an approval-gated candidate patch. Never conflate a generated remediation with a validated fix.