How to use Copilot to build a security bug workflow
The author used GitHub Copilot with Opus and Gemini to construct a security research harness and carry a library bug through upstream remediation.
news.ycombinator.com
Suggested prompt
Suggested prompt written by Agents In Use, not the source author. Replace bracketed inputs and review tool permissions first.
Set up [repository URL] as a security research workspace. Assess history and advisories, inspect risk areas, configure analysis and fuzzing, and require a reproducible PoC and proposed patch for each finding. Use existing tools and Python scripts; pause for my review before upstream submission.
Reach people exploring AI agents
See placements →Evidence at a glance
Sourced account- Source author
- hedgehog
- Original account
- Read the source ↗
- Published
- Source link checked
- Reported result
- The first completed fix concerned an out-of-bounds read; upstream remediation took an estimated six weeks or two months.
- Human involvement
- The author steered the setup and worked with an upstream maintainer, who selected a broader remediation.
A linked account supports attribution. It does not mean we independently reproduced its result.
Report an issue with this case
Open correction emailOpens your email app with the case link included. Nothing is sent automatically.
How the agent did it
- Asked the agent to construct a security research harness.
- Steered the harness through substantial back and forth.
- Took the first completed fix through upstream remediation.
The author tested a security research workflow using Opus 4.5 and Gemini 3 Flash through GitHub Copilot. They asked the agent to set up a workspace as a bug and remediation factory, then spent considerable back and forth steering that setup into something reasonable.
The requested workflow began with a repository URL and risk assessment using commit history and advisories. It continued through code review, analysis and fuzzing, candidate proofs of concept, and proposed fixes suited to upstream contribution practices. The author emphasized existing tools, Python automation, and document templates. They found that requiring both a proof of concept and a patch reduced noisy output.
They took the first completed fix through upstream remediation. It involved an out-of-bounds read in a heavily fuzzed library that did not trigger ASan because the read hit another valid data structure. The author estimated six weeks or two months end to end. A maintainer chose a broader fix despite the submitted patch being functional.
Who it's for: security researchers able to investigate generated findings and work through upstream review.
Prompt
Suggested prompt (written by Agents In Use, not the author's)
Source: Hacker News · hedgehog
Frequently asked questions
Which models and interface did the author use?
The tests primarily combined Opus 4.5 and Gemini 3 Flash running in GitHub Copilot.
Did the generated patch become the final fix?
The author describes the patch as functional, but says the maintainer chose a wider change that they considered cleaner.
More details
About this account
The agents helped construct the harness and produce bug findings, proofs of concept and proposed patches.
Platform: Hacker News. Attribution: https://news.ycombinator.com/item?id=48135824. Prompt: Suggested (written by Agents In Use, not the author's). Sourced by the Agents In Use pipeline.
Credit: hedgehog on Hacker News
Source published
Added to Agents In Use
Source checked
Tools and topics
GitHub Copilot · Opus 4.5 · Gemini 3 Flash · Python · ASan
Security research · Fuzzing
Editorial completeness: 100/100. Measures documented fields, not agent performance or verified outcomes.