stackforge Security Research

5 articles in this topic.

RSS

March 2026

5 articles

  1. Six AI Agents, One Security Company: The Paperclip AI Experiment

    We used Paperclip AI to stand up a six-agent AI company that now runs our exploit research pipeline almost entirely on autopilot - CVE candidate selection, forge dispatch, results collection, and SEO all managed autonomously. A CEO, a security researcher, a software engineer, a QA reviewer, a research intern, and a pipeline operator - all AI agents. They refactored four codebases into a clean monorepo, hardened the security, and built the MCP tools that now let the whole chain run without us touching a terminal. Four days, 135 issues, $180. The $1.38 QA agent found a bypass in the $115 engineer's security fix. This is the full story of the Paperclip AI experiment.

    22 min read EIP Team paperclip-aipaperclipai-agents
    22 min read

  2. CVE-2025-68670 Part 2: From Crash to RCE - The One That Fought Back (and Lost)

    The first post ended with 'not a shell.' This one ends with uid=0(root) - with an asterisk. Ten context windows. A UTF-8 encoding barrier that blocks every libc address. A PLT mapping that lied. A stack alignment problem solved by a NULL pointer and a filename that shouldn't exist. The story of how a pre-auth xrdp overflow became (almost) pure-network RCE - through the most absurd gadget chain we've ever built.

    27 min read EIP Team cve-2025-68670stackforgeshannon
    27 min read