https://exploit-intel.com/blog/tags/cveforge/EIP research articles tagged cveforge.en-usMon, 16 Mar 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/six-ai-agents-one-security-company-the-paperclip-experiment/https://exploit-intel.com/blog/posts/six-ai-agents-one-security-company-the-paperclip-experiment/We used Paperclip AI to stand up a six-agent AI company that now runs our exploit research pipeline almost entirely on autopilot - CVE candidate selection, forge dispatch, results collection, and SEO all managed autonomously. A CEO, a security researcher, a software engineer, a QA reviewer, a research intern, and a pipeline operator - all AI agents. They refactored four codebases into a clean monorepo, hardened the security, and built the MCP tools that now let the whole chain run without us touching a terminal. Four days, 135 issues, $180. The $1.38 QA agent found a bypass in the $115 engineer's security fix. This is the full story of the Paperclip AI experiment.Mon, 16 Mar 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cve-2026-3910-v8-maglev-autonomous-exploit/https://exploit-intel.com/blog/posts/cve-2026-3910-v8-maglev-autonomous-exploit/A V8 Maglev JIT bug exploited in the wild by state actors. An autonomous pipeline that found it, exploited it in seven attempts, then bypassed both fixes -- in 75 minutes for $14.38. The compiler said it was a Smi. It wasn't.Mon, 16 Mar 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cve-2026-4105-systemd-machined-privilege-escalation/https://exploit-intel.com/blog/posts/cve-2026-4105-systemd-machined-privilege-escalation/CVE-2026-4105 dropped this morning - local privilege escalation to root on desktop Linux via systemd-machined. Two D-Bus calls, no authentication. We fed it to CVEForge before the advisory was an hour old. Seventy-two minutes later: confirmed exploit, Docker labs for vulnerable and patched builds, and a bypass proving the vendor's fix is incomplete. The analysis agent said the fix was thorough. The bypass agent proved it wrong.Fri, 13 Mar 2026 22:00:00 -0400https://exploit-intel.com/blog/posts/cve-2026-28391-openclaw-command-injection-the-day-i-hacked-myself/https://exploit-intel.com/blog/posts/cve-2026-28391-openclaw-command-injection-the-day-i-hacked-myself/CVE-2026-28391 is a CVSS 9.8 command injection in OpenClaw < 2026.2.2, caused by a POSIX vs cmd.exe shell-parsing mismatch. Our own suggestion algorithm ranked it as the most interesting CVEForge target. 8/8 bypass vectors confirmed, code execution verified. This is the story of the day our orchestration layer dispatched a full vulnerability assessment against itself.Mon, 09 Mar 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cve-2025-26866-hugegraph-hessian-deserialization-autonomous-exploit/https://exploit-intel.com/blog/posts/cve-2025-26866-hugegraph-hessian-deserialization-autonomous-exploit/CVE-2025-26866 is a Hessian deserialization RCE in Apache HugeGraph PD. Our autonomous exploit pipeline CVEForge - which had completed 56 consecutive CVEs - hit a wall: an undocumented binary protocol, a non-standard serialization format, and a class blacklist blocking every known gadget chain. The agent spent $49 and four hours reverse-engineering SOFABolt, mapping sofa-hessian byte by byte, and finding a JDK-only gadget chain to bypass the blacklist. Then we took over to turn file creation into a proper root shell - navigating JNDI hardening, CC library defenses, and a gadget chain that silently dies on modern JDK. The result: a full Metasploit module.Sun, 01 Mar 2026 18:00:00 -0400https://exploit-intel.com/blog/posts/72-hours-24-cves-the-cveforge-stress-test/https://exploit-intel.com/blog/posts/72-hours-24-cves-the-cveforge-stress-test/We left CVEForge running for three days. Twenty-four CVEs went in. All twenty-four produced working PoCs. Ten incomplete fixes triggered eight responsible disclosure submissions - six GitHub issues, one MITRE report, one HackerOne 0-day. Here's the full accounting.Sat, 28 Feb 2026 18:00:00 -0400https://exploit-intel.com/blog/posts/two-cves-two-outcomes-foreman-command-injection-telnetd-privilege-escalation/https://exploit-intel.com/blog/posts/two-cves-two-outcomes-foreman-command-injection-telnetd-privilege-escalation/Foreman command injection via the REST API (CVE-2025-10622) and telnetd privilege escalation through environment variable injection (CVE-2026-28372) - CVEForge analyzes both end-to-end. One fix is a proper server-side whitelist. The other is a single unsetenv() call on a blacklist from 1995. Both produced working PoCs. Only one produced a fix we'd trust.Fri, 27 Feb 2026 18:00:00 -0400https://exploit-intel.com/blog/posts/five-cves-three-bypasses-java-case-study/https://exploit-intel.com/blog/posts/five-cves-three-bypasses-java-case-study/In this CVEForge patch-validation run, we analyze CVE-2025-60355 in OneBlog (Java/FreeMarker) and compare outcomes across five CVEs. Three of five runs ended in confirmed bypass or incomplete-fix results.Fri, 27 Feb 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/zero-to-rce-autonomous-exploit-development/https://exploit-intel.com/blog/posts/zero-to-rce-autonomous-exploit-development/After CVEForge's first successful run, we needed to know if it was luck or a pattern. Two more CVEs, zero hand-holding, and an AI agent that found a fix bypass the developers missed.Thu, 26 Feb 2026 12:00:00 -0400https://exploit-intel.com/blog/posts/cveforge-from-shannon-to-autonomous-poc/https://exploit-intel.com/blog/posts/cveforge-from-shannon-to-autonomous-poc/We forked Shannon - the open-source AI pentesting framework - and wired it to the EIP MCP server. Six AI agents, one CVE number, 32 minutes: a working RCE PoC for a CVSS 10.0 vulnerability with zero existing public exploits. Here's how it happened.Wed, 25 Feb 2026 12:00:00 -0400