How to use Unknown to build a security bug workflow
The author used GitHub Copilot with Opus and Gemini to construct a security research harness and carry a library bug through upstream remediation.
news.ycombinator.comPrompt to try
Editorial adaptation, not the source author’s exact prompt. Replace bracketed inputs and review tool permissions first.
Set up [repository URL] as a security research workspace. Assess history and advisories, inspect risk areas, configure analysis and fuzzing, and require a reproducible PoC and proposed patch for each finding. Use existing tools and Python scripts; pause for my review before upstream submission.
Reach people exploring AI agents
See placements →What happened
The first completed fix concerned an out-of-bounds read; upstream remediation took an estimated six weeks or two months.
Reported by hedgehog on Hacker NewsHow the agent did it
- Asked the agent to construct a security research harness.
- Steered the harness through substantial back and forth.
- Took the first completed fix through upstream remediation.
Where a person stepped in
The author steered the setup and worked with an upstream maintainer, who selected a broader remediation.
A person approved each step before the agent continued.
The author tested a security research workflow using Opus 4.5 and Gemini 3 Flash through GitHub Copilot. They asked the agent to set up a workspace as a bug and remediation factory, then spent considerable back and forth steering that setup into something reasonable.
The requested workflow began with a repository URL and risk assessment using commit history and advisories. It continued through code review, analysis and fuzzing, candidate proofs of concept, and proposed fixes suited to upstream contribution practices. The author emphasized existing tools, Python automation, and document templates. They found that requiring both a proof of concept and a patch reduced noisy output.
They took the first completed fix through upstream remediation. It involved an out-of-bounds read in a heavily fuzzed library that did not trigger ASan because the read hit another valid data structure. The author estimated six weeks or two months end to end. A maintainer chose a broader fix despite the submitted patch being functional.
Who it's for: security researchers able to investigate generated findings and work through upstream review.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Hacker News · hedgehog
Frequently asked questions
Which models and interface did the author use?
The tests primarily combined Opus 4.5 and Gemini 3 Flash running in GitHub Copilot.
Did the generated patch become the final fix?
The author describes the patch as functional, but says the maintainer chose a wider change that they considered cleaner.
More details
About this account
The agents helped construct the harness and produce bug findings, proofs of concept and proposed patches.
Platform: Hacker News. Attribution: https://news.ycombinator.com/item?id=48135824. Prompt: Suggested (written by Agents In Use, not the author's). Sourced by the Agents In Use pipeline.
Credit: hedgehog on Hacker News
Source published 14 May 2026
Source checked 14 Oct 2026
Tools and topics
GitHub Copilot · Opus 4.5 · Gemini 3 Flash · Python · ASan
Security research · Fuzzing
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.