Sentinel
Michael Sargis · 2026 · Research project
A security research agent that has to reproduce a bug before it can call it a finding.
The problem
A model can produce a convincing vulnerability report for code that is perfectly fine. The report reads well. The engineer loses an afternoon.
Sentinel reads a repository, proposes a failure, and tests it in an isolated environment. Every confirmed finding includes a minimal reproduction and the exact revision it affects. All runs stay within explicitly authorized code and test systems.
Results
In its first month, Sentinel found 41 previously unknown vulnerabilities across participating open-source projects. The most useful findings involved authorization checks that worked individually but failed when two services disagreed about who owned a resource.
Reports went privately to maintainers. Public write-ups wait until the affected versions have a patch.
The patch is another hypothesis
Finding the bug is half the job. Sentinel reruns the reproduction against the fix, then checks nearby cases that the original test did not cover. A patch that only recognizes the first failing input does not count.
I built the repository analysis, isolated test runner, and patch-verification loop. The output is a failing test that becomes a passing test, with enough context for someone else to check the work.