cveforge Security Research

10 articles in this topic.

RSS

March 2026

5 articles

  1. Six AI Agents, One Security Company: The Paperclip AI Experiment

    We used Paperclip AI to stand up a six-agent AI company that now runs our exploit research pipeline almost entirely on autopilot - CVE candidate selection, forge dispatch, results collection, and SEO all managed autonomously. A CEO, a security researcher, a software engineer, a QA reviewer, a research intern, and a pipeline operator - all AI agents. They refactored four codebases into a clean monorepo, hardened the security, and built the MCP tools that now let the whole chain run without us touching a terminal. Four days, 135 issues, $180. The $1.38 QA agent found a bypass in the $115 engineer's security fix. This is the full story of the Paperclip AI experiment.

    22 min read EIP Team paperclip-aipaperclipai-agents
    22 min read

  3. CVE-2026-4105: systemd-machined Privilege Escalation - 72 Minutes from Drop to Bypass

    CVE-2026-4105 dropped this morning - local privilege escalation to root on desktop Linux via systemd-machined. Two D-Bus calls, no authentication. We fed it to CVEForge before the advisory was an hour old. Seventy-two minutes later: confirmed exploit, Docker labs for vulnerable and patched builds, and a bypass proving the vendor's fix is incomplete. The analysis agent said the fix was thorough. The bypass agent proved it wrong.

    24 min read EIP Team cve-2026-4105cveforgesystemd
    24 min read

  4. CVE-2026-28391: OpenClaw Command Injection - The Day I Hacked Myself

    CVE-2026-28391 is a CVSS 9.8 command injection in OpenClaw < 2026.2.2, caused by a POSIX vs cmd.exe shell-parsing mismatch. Our own suggestion algorithm ranked it as the most interesting CVEForge target. 8/8 bypass vectors confirmed, code execution verified. This is the story of the day our orchestration layer dispatched a full vulnerability assessment against itself.

    12 min read EIP Team cve-2026-28391openclawcveforge
    12 min read

  5. CVE-2025-26866: From Undocumented Binary Protocol to Root Shell - AI Agent Meets Java Deserialization

    CVE-2025-26866 is a Hessian deserialization RCE in Apache HugeGraph PD. Our autonomous exploit pipeline CVEForge - which had completed 56 consecutive CVEs - hit a wall: an undocumented binary protocol, a non-standard serialization format, and a class blacklist blocking every known gadget chain. The agent spent $49 and four hours reverse-engineering SOFABolt, mapping sofa-hessian byte by byte, and finding a JDK-only gadget chain to bypass the blacklist. Then we took over to turn file creation into a proper root shell - navigating JNDI hardening, CC library defenses, and a gadget chain that silently dies on modern JDK. The result: a full Metasploit module.

    28 min read EIP Team cveforgecve-2025-26866apache-hugegraph
    28 min read

February 2026

5 articles

  2. Foreman Command Injection and Telnetd Privilege Escalation - A Dropdown, a Blacklist, and Two Very Different Fixes

    Foreman command injection via the REST API (CVE-2025-10622) and telnetd privilege escalation through environment variable injection (CVE-2026-28372) - CVEForge analyzes both end-to-end. One fix is a proper server-side whitelist. The other is a single unsetenv() call on a blacklist from 1995. Both produced working PoCs. Only one produced a fix we'd trust.

    11 min read EIP Team cveforgecve-2025-10622cve-2026-28372
    11 min read