Autonomous Bug-Bounty Pipeline

First live engagement: 55 hypotheses closed, 3 findings triaged on the platform. The pipeline ran end-to-end on a public Cantina program covering four Solidity contract suites. Every hypothesis was either struck with quoted-code rationale or confirmed with a passing Foundry proof-of-concept on a local blockchain fork. One Low finding pinned 634 USDC.e stranded in a deployed contract.

Watches four bounty platforms and starts the deep audit the moment scope changes — no human in the loop until findings exist. It polls every 15 minutes and detects silently-added contracts by hashing each program's assets, rewards, and rules. On a trigger it scaffolds a structured workspace and launches a swarm of AI workers that read the code adversarially and draft findings.

It runs the work no person can keep up with: nine attack surfaces audited in parallel, hundreds of hypotheses tracked at once. Each worker owns one surface — reentrancy, signatures, arithmetic, oracle, access control, deployment archaeology, cross-contract, fuzzing, web — in its own isolated copy of the code. A supervisor nudges stalled workers, waits out API limits and resumes, and never lets a worker submit on its own.

Nothing reaches a platform without a human clicking submit; every proof-of-concept runs on a safe local copy of the chain. The operator gets a phone call that re-dials until acknowledged, reviews the drafted findings, and decides what to submit. Any worker that tries to submit is flagged loudly and stopped.

The whole pipeline was built and tested in two days — 19 commits, then a live engagement. It is fully testable offline: a simulated Claude stands in for the real one, so the test suite never touches the network or spends API money.