Science

$10/month hackbot finds privilege escalation vuln in first hour

vulnix set up a Hermes agent with a $10 OpenCode subscription and DeepSeek V4.1 Flash, running scout, researcher, reviewer, and submitter bots. It found a privilege escalation vulnerability in Omarchy within its first hour.

View on X
919likes
56reposts
1.4Ksaves
49Kviews
Made with
Hermes, OpenCode, DeepSeek V4.1 Flash
Posted
vulnix@vulnix0x4

my $10/month hackbot found a privilege escalation vuln in @omarchy in its first hour.

setup:

1. run hermes agent on a device that stays on 24/7
2. get a $10 opencode subscription
3. set model to deepseek v4.1 flash
4. paste the prompt (in replies)

it runs 4 bots:
→ scout: picks the hackerone program most likely to pay out
→ researcher: finds vulns, builds PoCs, saves evidence
→ reviewer: tries to reproduce and disprove every finding
→ submitter: writes the report and uploads evidence, checks with you before submitting

it texts me when it finds something 👇

View on X

More in Science