rush

Inspiration

In routine cybersecurity defense and penetration testing, security engineers often spend massive amounts of time on repetitive asset discovery, writing custom scripts, and analyzing logs. We wanted to break this inefficient workflow, which led to the conceptualization of Rush—an intelligent security agent capable of understanding complex security intents and automatically generating code to execute reconnaissance and testing tasks.

What it does

Rush is an AI-driven cybersecurity automation workflow engine. Users simply input natural language commands (e.g., "Find all edge assets for the target domain via FOFA, remove duplicate ports, and check for common vulnerabilities"), and Rush handles the entire process.

It leverages GPT-5.6 for threat modeling and task breakdown, then calls Codex to dynamically generate Python or command-line scripts (compatible with PowerShell 7 and various Linux terminals). This allows it to directly interface with various security tool APIs to automate asset discovery, customized scanning, and data cleaning.

How we built it

We targeted the "Developer Tools" and "Work & Productivity" tracks, building the core architecture with Python and strictly integrating the models as required by the hackathon:

GPT-5.6 (The Brain): Parses the natural language of security personnel, breaks down complex security testing workflows into structured task queues, and handles the final analysis of security logs.

Codex (The Hands): Based on the task instructions assigned by GPT-5.6, it writes, debugs, and executes customized vulnerability detection scripts and data-scraping code in real-time.

Environment Integration: We built a secure local execution sandbox for Rush, allowing it to seamlessly call local terminal tools and network request libraries for direct practical interaction.

Challenges we ran into

The biggest challenges were "precise control" and "security boundaries." Since the test scripts generated in real-time by Codex inherently carry some uncertainty, we had to ensure that executing scans or sending payloads wouldn't have a destructive impact on target servers. Furthermore, uniformly cleaning unstructured output data from multiple security tools and feeding it to GPT-5.6 severely tested our architectural design capabilities in handling complex JSON responses and avoiding token limits.

Accomplishments that we're proud of

We are most proud of successfully building a closed-loop collaboration mechanism between GPT-5.6 and Codex. With minimal human intervention, Rush can independently complete the entire attack surface mapping pipeline: "Strategy Formulation -> Script Generation -> Test Execution -> Feedback Analysis." In our internal testing, this automated workflow reduced the time required for single-target asset information gathering and preliminary analysis by over 80%.

What we learned

We profoundly realized that in the highly rigorous field of cybersecurity, prompt engineering for large models must be extraordinarily precise. Concurrently, we discovered that Codex has an astonishing understanding of various cybersecurity libraries and API documentation; given the appropriate context, it can write highly effective practical scripts. This revealed the massive potential of AI Agents in daily penetration testing workflows.

What's next for rush

Next, we plan to develop a "Security Audit Mode" for Rush, allowing generated code to be quickly reviewed and intercepted by security engineers before execution. Additionally, we will deepen the local integration ecosystem with mainstream security testing platforms (like Burp Suite) and optimize the underlying process diagnostic functions, striving to make Rush the standard intelligent assistant for every cybersecurity practitioner.

Built With

• websecurity