| 1 | # Cyclops v2 - Knowledge Core |
| 2 | |
| 3 | This is the binding knowledge vault for **Cyclops v2**, a ground-up rebuild of an autonomous |
| 4 | offensive-security research agent. Open it as an Obsidian vault (the `.obsidian/` folder is here). |
| 5 | |
| 6 | ## Why v2 exists |
| 7 | |
| 8 | Cyclops v1 was a **code-reader**, not an **exploit-runner**. It found bugs by reading source and |
| 9 | pattern-matching known shapes. The consequences were structural, not incidental: |
| 10 | |
| 11 | - It drifted to the same low-severity classes forever (IDOR / broken access control / blind SSRF). |
| 12 | - It got tunnel-vision on one target and never rotated its angle of attack. |
| 13 | - It never *proved* RCE / shell / account-takeover - it asserted reachability and called it a day. |
| 14 | - It only ever found **sibling-CVEs** (variants of already-public bugs), never novel ones. |
| 15 | - The output read like hackathon offsec slop: confident, plausible, unproven. |
| 16 | |
| 17 | ## The v2 thesis (the three pillars) |
| 18 | |
| 19 | Novel, high-severity bugs come from the intersection of: |
| 20 | |
| 21 | 1. **The right target archetypes** - hunt where load-time RCE and trust-boundary confusion *live*, |
| 22 | not where CRUD apps leak object IDs. See [[01-archetypes/electron-desktop|archetypes]]. |
| 23 | 2. **Code Property Graph dataflow** - use [[06-methods/NOVELTY-DOCTRINE|CPG/Joern]] to find |
| 24 | *reachable sinks nobody has looked at*, instead of grepping for known-CVE shapes. |
| 25 | 3. **A dynamic oracle** - only an ASan crash, a popped shell, or a retrieved secret may declare a |
| 26 | finding. An LLM's opinion is never proof. See [[00-doctrine/OPERATING-CORE|the operating core]]. |
| 27 | |
| 28 | ## Map of the vault |
| 29 | |
| 30 | - [[00-doctrine/OPERATING-CORE]] - the binding charter (authorization, proof labels, anti-drift). |
| 31 | - [[00-doctrine/SEVERITY-GATE]] - the hard gate; what counts as a "holy-shit" finding and the exact oracle per family. |
| 32 | - `01-archetypes/` - one hunting playbook per target archetype: |
| 33 | - [[01-archetypes/ml-model-loaders]] **(headline archetype - most depth)** |
| 34 | - [[01-archetypes/electron-desktop]] |
| 35 | - [[01-archetypes/ai-agent-mcp]] |
| 36 | - [[01-archetypes/devops-infra]] |
| 37 | - [[01-archetypes/cicd-supplychain]] |
| 38 | - [[01-archetypes/memory-unsafe-parsers]] |
| 39 | - [[06-methods/NOVELTY-DOCTRINE]] - how to avoid being beaten to the punch; sibling-CVE discipline. |
| 40 | - [[04-cleared-axes/README|04-cleared-axes]] - the anti-tunnel-vision memory (what we've already screened). |
| 41 | |
| 42 | ## The one-line spine |
| 43 | |
| 44 | > Hunt the right archetypes → use the CPG to find an unexplored source→sink path → drive it with a |
| 45 | > dynamic oracle until you have an **execution artifact** on the path to a [[00-doctrine/SEVERITY-GATE|gate]] |
| 46 | > family - or you log it **DISPROVEN** and rotate. No artifact, no report. |