huntback says someone used coding agents to orchestrate vulnerability research tasks
When the pentester is a fleet of AI agents: inside an autonomous vuln-hunting rig
huntback recovered an offensive security operation run almost entirely by AI agents on an exposed server at Contabo GmbH (37.60.248.174), totaling 365 files. The operator built a platform named Brainstorm, from which an orchestration layer spawned Claude Code agents named germinal, strategist, and Ask Code, each taking on scanning, source code reading, and triage roles, with results written to transcripts for later human review. The platform had its own out-of-band collaborator, using a unique token per payload to confirm blind XXE, SSRF, SSTI, RCE, and deserialization over DNS, HTTP, SMTP, and LDAP, replaying after restarts. The code references both Anthropic and Kimi (Moonshot) backends and can switch model providers, so detection based on vendor API domains can easily fail.