BugBounty Swarm — Autonomous Multi-Agent Security Fleet

Autonomous multi-agent security fleet on Gemini 3.5 & Google Cloud that crawls, tests multi-tenant APIs, debates hypotheses, and proves real vulnerabilities with 0 hallucinations.

Comment

Inspiration

Securing modern enterprise APIs is one of the most critical challenges in software engineering today. Traditional DAST scanners flood security engineers with false positives, while single-prompt LLM chatbots hallucinate fake vulnerabilities that waste hundreds of triage hours.

We asked: What if an institutional fleet of specialized AI agents could collaborate, crawl live endpoints, formulate adversarial attack vectors, and deterministically verify every vulnerability through real HTTP socket execution with zero hallucinations?

That vision is BugBounty Swarm — an autonomous multi-agent AI security research fleet built on Google Gemini 3.5 Flash and Google Cloud.

What it does

BugBounty Swarm automates the entire end-to-end vulnerability research lifecycle:

  1. Passive & Active Reconnaissance (ReconAgent): Discovers endpoints, OpenAPI schemas, sitemaps, and parameter signatures across target web applications.
  2. Attack Surface Normalization (AttackSurfaceAgent): Maps dynamic URL templates (e.g., {{order_id}}) into concrete, testable boundary matrices.
  3. Adversarial Hypothesis Probing (HunterAgent): Formulates multi-tenant BOLA/IDOR, SSRF, JWT signature bypass, and privilege escalation attack vectors across isolated tenant credentials.
  4. Deterministic Socket Probing (EvidenceCollector): Dispatches asynchronous HTTP/HTTPS socket requests in Python — capturing raw HTTP request/response proofs and completely eliminating LLM hallucinations.
  5. Anti-Hallucination Gatekeeper (ReviewerAgent): Evaluates evidence against a strict 5-branch semantic validation gate. Negative controls and false leads are immediately rejected, while genuine breaches are verified with cryptographic certainty.
  6. Advisory Compilation (ReporterAgent): Synthesizes verified findings into complete, publication-ready HackerOne / Bugcrowd advisories with CVSS 3.1 scoring, differential evidence, reproduction curl PoCs, and developer remediation patches.

How we built it

  • AI Core: Google Gemini 3.5 Flash via the official google-genai SDK for low-latency reasoning, structured tool invocation, and multi-agent orchestration.
  • Backend Architecture: Asynchronous Python microservice framework with FastAPI, HTTPX, and Pydantic v2.
  • Cloud Infrastructure: Serverless container execution on Google Cloud Run and durable event streaming backed by Google Cloud Firestore.
  • Real-Time Telemetry: Reactive WebSocket & Server-Sent Events (SSE) telemetry pipeline delivering live multi-agent execution feeds to the dashboard.
  • Frontend Dashboard: High-tech cyber command center built with React, Vite, Tailwind CSS, and Lucide Icons.
  • Model Armor & Guardrails: 4-layer zero-trust scope gatekeeper enforcing RFC 1918 private subnet blocking, cloud metadata (169.254.169.254) isolation, and strict session authorization.

Challenges we ran into

  • Eliminating LLM Hallucinations: Early LLM prompts would sometimes claim a vulnerability existed based on superficial keyword matches. We solved this by creating a decoupled EvidenceCollector that executes real HTTP socket requests and requires deterministic status-code differentials before a finding can even reach the ReviewerAgent.
  • Handling Multi-Tenant Authorization Boundaries: Testing BOLA/IDOR requires maintaining strict credential boundaries. We engineered a dynamic SessionVault with tenant token rotation to verify true cross-account access violations.

Accomplishments that we're proud of

  • 100% Automated Multi-Agent Collaboration: 6 specialized agents working together in a synchronized pipeline without manual intervention.
  • Real Vulnerability Discovery: Confirmed real Critical JWT alg=none authentication bypass, SSRF egress, and BOLA on hardened targets in under 3 minutes.
  • 237 Automated Unit Tests: Robust test suite verifying scope enforcement, SSRF prevention, state machines, and report synthesis.
  • Instant Cloud Run & Local Deployment: Production Docker multi-stage build running locally or globally scalable on Google Cloud.

What we learned

  • Multi-agent collaboration with specialized roles (Hypothesis -> Socket Execution -> Semantic Review) achieves vastly higher accuracy than single monolithic prompts.
  • Structured output schemas with Pydantic and Gemini enable deterministic JSON event streaming for live security operations.

What's next for BugBounty Swarm — Autonomous Multi-Agent Security Fleet

  • Burp Suite Enterprise & ZAP Extension: Direct live traffic ingestion from proxy flows.
  • Continuous CI/CD Pipeline Scanning: Automated PR security audits on GitHub Actions backed by Google Cloud Tasks.
  • Expanded Vulnerability Classes: Deep semantic testing for GraphQL authorization flaws, Race Conditions, and Server-Side Template Injection (SSTI).

Built With

  • artificial-intelligence
  • bug-bounty
  • cybersecurity
  • docker
  • fastapi
  • google-cloud-firestore
  • google-cloud-run
  • google-gemini
  • httpx
  • pydantic
  • python
  • react
  • tailwindcss
  • vite
Share this project:

Updates

Submission history