OperonSec
Request access

Autonomous AI security researcher

Offensive researchthat shows its work.

Every candidate is replayed by a validator that never saw the hunt. Proof, not alerts.

Request accessSee how it hunts
operonsec · engagementLive
Attack graph: recon and the JavaScript map lead to accounts A and B. One branch is explored and closed with nothing found; the differential test between A and B produces a verified finding.targetreconjs mapaccount Aaccount Bcoveragenothing foundA/B diffverified
  1. orchestratorscope loaded · 2 hosts
  2. recon214 routes, 3 roles mapped
  3. operator Asigned up, session captured
  4. coverageinvoices explored · nothing found
  5. differB read A's order · candidate
  6. validatorcold start · reproduced

Target in. Proof out.

One finding, from scope to the report you submit.

  1. First, the scope is locked.

    Out-of-scope hosts are blocked in code before any tool runs.

    scopelocked
    in scope
    app.example.com, api.example.com
    out of scope
    payments.example.com, /admin/*
    rate limit
    5 req/s per host
    accounts
    A, B (self-registered)

    GET payments.example.com/v1/cardsblocked

  2. Then every route is mapped.

    Hosts, routes and roles, from crawling and the app's own JavaScript.

    map214 routes · 3 roles
    routeroles
    GET /api/v2/orders/{id}userauthz
    POST /api/v2/ordersuser
    GET /api/v2/invoices/{id}/pdfuserauthz
    PUT /api/v2/admin/users/{id}adminauthz
    POST /api/auth/resetanon

  3. Two accounts test each flow.

    Real browsers, real sessions. If B can read what A owns, that's a candidate.

    differ · orders2 accounts
    1. APOST /api/v2/orders201 · id 4471
    2. BGET /api/v2/orders/4471200 · owner A

    B read A's ordercandidate

  4. A cold validator replays it.

    No transcript, no reasoning. Only the claim and the target, three times.

    validator · cold startcontext: empty
    1. run 1GET /api/v2/orders/4471as B200 · owner A
    2. run 2GET /api/v2/orders/4471as B200 · owner A
    3. run 3GET /api/v2/orders/4471as B200 · owner A

    input: claim and target onlyreproduced 3/3

  5. You review it, then submit.

    Evidence, CVSS and CWE, ready to read. Nothing is sent without you.

    finding · sampleverified

    Broken object-level authorization

    Medium · CVSS 6.5CWE-639replayed 3/3

    GET /api/v2/orders/{id} · account B reads account A's order

    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

    human: pendingready for review

  • One orchestrator. Narrow squads.

    Each squad has its own instructions, tools and container image.

  • Orchestrator

    Plans the hunt, hands off work and pushes for harder tests. Never approves its own findings.

  • Recon

    Hosts, routes, roles and the JavaScript map.

  • Analysis

    Reads client code and shipped source.

  • Coverage

    Tracks what hasn't been tested yet.

  • Exploit

    Two accounts in real browsers, every flow.

  • Chain

    Joins low findings into real impact.

  • Verify

    Cold replay with no transcript.

  • Report

    Evidence, CVSS and CWE, written for you.

Root inside the box. Nobody outside it.

Agents get root inside three nested rings. A compromised agent stays trapped.

  • Cloudflare and Caddy. TLS end to end; the origin only answers through Cloudflare.

  • The orchestrator runs in a non-root outer container. No Docker socket, no privileged mode.

  • One short-lived container per task. Root inside maps to nobody on the host.

  • A network per engagement. No metadata service, no internal hosts; only in-scope traffic leaves.

operonsec ps5 containers
containerringuser (inside → host)networkegress
orchestratorBoperon → 100000eng-0142scope only
recon-01Croot → nobodyeng-0142scope only
exploit-a-02Croot → nobodyeng-0142scope only
exploit-b-03Croot → nobodyeng-0142scope only
validator-04Croot → nobodyeng-0142 · freshscope only

egress to 169.254.169.254 (metadata)blocked

Bounded by code, not good intentions.

Requests outside the scope are blocked403 out of scopebefore they leave. Nothing a target says can change the rulesignored: injected instruction. Every report cites the stored requestreq #8812and its screenshot. And nothing is submitted without yousubmit: human only.

Request early access.

Opening in small batches to researchers who test authorized targets.

Early access opens soon. Not collecting submissions yet.

Questions, answered.

Is OperonSec available?

Not yet. It's an early research system, and access opens gradually.

Which targets can it test?

Only targets you are authorized to test, within their published scope and rules. Scope is enforced in code.

Does it submit reports for me?

No. It prepares a reproducible report; you review it and submit it yourself.

Which AI models does it use?

Several providers, including DeepSeek and GLM, with a model chosen per agent role.

Can I test OperonSec itself?

No. Testing of operonsec.com or any OperonSec system is not authorized.