ddiinn

honeyslop is code canaries, decoys, for open-source projects drowning in AI-hallucinated ("slop") and unverified vulnerability reports. A slop scanner ingests the canary, then generates a vulnerability "report" based on it. The report self-identifies as slop. Close it in one grep.

This is a quick PoC, vibe-coded as a joke (not production-grade), because we received a slop report at raptor, ourselves. Should be fun!

Knostic is open-sourcing OpenAnt, our LLM-based vulnerability discovery product, similar to Anthropic's Claude Code Security, but free. It helps defenders proactively find verified security flaws. Stage 1 detects. Stage 2 attacks. What survives is real.

Why open source? Since Knostic's focus is on protecting agents (not vulnerability research), we're releasing OpenAnt for free. Plus, we like open source. ...And besides, it makes zero sense to compete with Anthropic and OpenAI.

Links: - Project page: https://openant.knostic.ai/

- For technical details, limitations, and token costs, check out this blog post: https://knostic.ai/blog/openant

- To submit your repo for scanning: https://knostic.ai/blog/oss-scan

- Repo: https://github.com/knostic/OpenAnt/

Releasing open source tools for security teams to get visibility into OpenClaw in their environments: openclaw-detect and openclaw-telemetry.

- openclaw-detect: Shell and PowerShell scripts that detect OpenClaw installations on managed devices. Checks for CLI binaries, app bundles, config files, gateway services, and Docker artifacts across macOS, Linux, and Windows. Deployable via MDM with docs for Intune, Jamf, JumpCloud, Kandji, and Workspace ONE.

Repo: https://github.com/knostic/openclaw-detect

- openclaw-telemetry: A plugin for OpenClaw that captures tool calls, LLM usage, agent lifecycle, and message events. Includes sensitive data redaction, tamper-proof hash chains, rate limiting, and log rotation. Outputs to JSONL, with optional CEF/syslog forwarding for SIEM integration (not yet tested).

Repo: https://github.com/knostic/openclaw-telemetry

Thanks! The Knostic team

RAPTOR empowers security research with agentic workflows and automation. It combines traditional security tools with agentic automation and analysis, deeply understands your code, proves exploitability, and proposes patches.

First use: It generated patches for the FFmpeg Project Zero vulnerabilities.

It's also a PoC showing coding agents are generic, and can be adapted like a "WinAmp skin" for any purpose.

Written by Gadi Evron, Daniel Cuthbert, Thomas Dullien (Halvar Flake), and Michael Bargury.

https://github.com/gadievron/raptor/

3-5 minutes on the clock per demonstration, ranging from MCP && auto reverse engineering to writing cyber security songs with AI. The event last week was incredible, this week's is tomorrow (Thursday).

I'm CEO of Cymmetria, please feel free to ask any questions about this.

The system will not catch everything in any way - but what it does catch has no false positives by definition. We're very happy to demonstrate live the value proposition and how alerting is one aspect of what we do.

Thanks for the kind words, Thomas. Sandboxing is a very minor part of what we do, I'd be happy to share.

Thank you, we appreciate it. :)

Thanks for your support!

Thank you. :)

Hi all, Gadi here (CEO of Cymmetria). We are here on Hacker News and would be happy to answer any questions, technical or otherwise, and discuss.