The research atlas for
autonomous security agents.
A curated, indexed knowledge base for building an AI agent that performs authorised bug-bounty hunting and vulnerability discovery — 1216 sources, 15 papers, 36 repositories and a full vulnerability and tooling taxonomy.
tip: press / in the library to focus search · 401 distinct hosts · 981 annotated
Three ways into the archive
Every page is generated from the research data in this repository.
Source library
Search and filter 1,216 curated sources across 19 research collections, with descriptions and direct links.
browse →Papers
15 downloaded papers on LLM fuzzing, prompt-injection defence and autonomous agents — 4 flagged as anchor reading.
read →Agent blueprint
8 architecture insights from verified research, plus the four-phase roadmap from archive to working agent.
design →Research collections
Each collection is one deep-research batch. All 19 are browsable.
OAuth, OIDC & SSO
Redirect-URI abuse, token theft, PKCE weaknesses and single-sign-on bypasses.
Cloud IAM & Attack Paths
Cross-account privilege escalation and attack-path analysis in AWS, Azure and GCP.
GraphQL & API Security
Introspection abuse, authorization testing and automated API security workflows.
Web3 & Smart Contracts
Reentrancy, oracle manipulation, MEV and smart-contract analysis tooling.
Dependency Confusion & CI/CD
Package-registry confusion, typosquatting detection and compromise of build pipelines.
Container Escape & Kubernetes
Container escapes, cluster privilege escalation and misconfiguration exploitation.
Papers that shape the design
Marked ★★★★★ in the research: architecture-defining rather than background.
ELFuzz: LLM-Synthesized Generation Fuzzers for Real-World Software anchor
Ohio State/NYU. CodeLlama-13B synthesizes Python-based generation fuzzers. Up to 434.8% more code coverage than second-best SOTA on cvc5 within 10 min. Fuzzer space model (lattice structure) contributes up to 62.5% to effectiveness.
OWASP Threat Modeling Cheat Sheet anchor
Four-question framework (Adam Shostack): What are we working on? / What can go wrong? / What are we going to do about it? / Did we do a good enough job? STRIDE categorization. anchor for agent workflow design.
OWASP Top 10:2025 anchor
A03:2025 Software Supply Chain Failures newly elevated to top-10. A01:2025 Broken Access Control remains #1. Based on NVD data (~175,000 CVEs, 643 CWEs), CVSSv2/v3, incidence rates. Data covers 2021-2024.
Sailor: Static Analysis-Guided LLM Harness Synthesis for Vulnerability Discovery anchor
UCSB paper. Three-phase pipeline: static analysis→LLM harness synthesis→symbolic execution→concrete validation. 379 vulns vs 12 by Claude Code alone across 10 C/C++ projects (6.8M LoC). Ablation: removing any component collapses results. anchor for agent architecture.
From archive to agent
1. Research & curation
This archive: sources, papers, repositories and taxonomies.
2. Architecture design
Agent roles, model routing, tool interface, scope enforcement and evidence capture.
3. Agent implementation
Recon, analysis, validation and reporting stages with deterministic guardrails.
4. Testing & iteration
Benchmarks against known targets, ablation studies and regression suites.
Evidence-first. The archive stores knowledge and methodology, not exploit code. Repositories are referenced read-only; the agent operates only against targets with written permission.
Authorised testing only. Nothing here grants permission to test a system. See the responsible-use policy.
What's inside
22 additional vulnerability classes · 149 tools in 20 categories · 19 collections · 15 papers.