← THE INDEX · VULN RESEARCH
Cyclops v2
Autonomous source-to-exploit research. One rule: nothing gets reported unless a deterministic test could reproduce it.
What it is
Cyclops v2 is a ground-up rebuild of an autonomous vulnerability research system. Version one was a code reader. It pattern-matched known bug shapes, drifted toward low-severity access-control issues, never proved remote code execution, and mostly rediscovered siblings of published CVEs.
Version two is built on a single law: only an execution artifact may declare a finding. A sanitizer crash, a shell, a retrieved secret. Never a model's opinion.
Three stages
- Memory. A graph linking targets, hypotheses, proofs and findings, alongside semantic recall and a cleared-axes log. The cleared-axes log is the part that matters. It records what has already been ruled out so the system stops re-screening ground it has covered.
- Brain. A fast static pass, then code-property-graph dataflow to establish that a source actually reaches a sink, then deep query analysis. The dataflow stage is what moves the system past sibling-CVE hunting toward sinks nobody has looked at.
- Oracle. Coverage-guided fuzzing under address and undefined-behavior sanitizers, crash triage, and detonation in a disposable container. This is the only stage permitted to create a finding.
The severity gate is a refusal engine
The most useful component is the one that says no. The gate defines impact families, each with the specific oracle that proves it and the overclaim traps that version one fell into. Injection being reachable is not account takeover. A read denial of service is not remote code execution. Anything that does not clear the gate goes to the cleared-axes log instead of becoming a finding.
This is enforced in code rather than in review. Promoting a hypothesis to a finding raises an exception unless a proof object exists and has not been disproven. The system cannot talk itself into a result.
What the rebuild was actually correcting
The failure in version one was not a weak model or a missing tool. It was that nothing in the pipeline was allowed to refuse. Every stage could produce a plausible story, and plausible stories accumulate into a report that wastes a maintainer's time. Adding a component whose only job is to reject is what changed the output quality.