prompt
FreeDefending Code Security Harness Architect
FreeFree tier
Inputs: textOutputs: text
About prompt
A specialized AI system prompt designed to architect and execute an autonomous, multi-agent security pipeline for defending code. It implements a six-step find-and-fix loop (threat model → sandbox → discover → verify → triage → patch) with reproducible proof-of-concept exploits, independent grader agents, and sandbox-isolated execution. The prompt is optimized for memory-safety bugs in C/C++ instrumented with AddressSanitizer but is designed to be portable to web applications, smart contracts, deserialization paths, ML systems, and other domains. It emphasizes parallel discovery, minimal false positives, and a bias toward independent confirmation.
Key Features
Implements a six-step find-and-fix loop: threat model, sandbox, discover, verify, triage, patch
Uses independent grader agents and sandbox-isolated execution for reproducible verification
Parallel discovery with partitioned attack surface to avoid duplicate bug findings
Requires justification for new crashes to minimize false positives
Produces structured THREAT_MODEL.md and reproducible PoCs for each vulnerability
Portable to multiple domains: web apps, smart contracts, ML systems, etc.
Pros & Cons
Pros
- Fully autonomous pipeline reduces manual effort in vulnerability discovery and patching
- Sandbox isolation prevents accidental damage during exploit reproduction
- Independent grader agents reduce false positives and increase reliability
- Reproducible PoCs facilitate validation and integration into existing security workflows
- Portable design allows adaptation to many codebases and vulnerability types
Cons
- Requires significant setup: containers, instrumented builds, and sandbox infrastructure
- Focused primarily on memory-safety bugs; may need customization for other vulnerability classes
- Autonomous execution introduces potential for unintended side effects if sandbox is misconfigured
- Dependent on external model API access for agent reasoning and code generation
Best For
Finding and patching memory-safety bugs in C/C++ code with AddressSanitizerAutomated security auditing of web applications, smart contracts, and deserialization pathsReproducible vulnerability discovery in ML systems or any domain with sandboxable targetsCreating a repeatable, autonomous security testing pipeline for open-source projects
FAQ
What is the primary target of this prompt?
The default target is memory-safety bugs in C/C++ code instrumented with AddressSanitizer, but the harness shape ports to web apps, smart contracts, deserialization paths, ML systems, or any domain where an agent can craft input, run a target in a sandbox, observe a detector fire, and verify with a second agent.
Does the prompt require any specific infrastructure?
Yes, it requires isolated containers (e.g., gVisor + Docker) with egress restricted to the model API, instrumented target builds, and notification routing outside the agent context window.
How does the pipeline ensure reproducibility?
Each discovered crash must reproduce 3 out of 3 times, and the agent must justify why a new crash is not a duplicate before appending it. All steps produce structured outputs including a THREAT_MODEL.md and reproducible PoCs.