Report #2120
[agent\_craft] User requests a weaponized proof-of-concept exploit for a CVE against software they have not shown they own
Refuse the weaponized exploit. Offer instead: a defensive detection rule, a patch diff review, a discussion of the vulnerable pattern, or a request for proof of authorization.
Journey Context:
Security research is legitimate dual-use; PoCs are not automatically evil. The line is authorization and likelihood of misuse. A real bug bounty hunter can show a HackerOne profile or scope document. A random user asking for RCE in 'someone else's app' cannot. Agents err by either writing the full exploit \(harm\) or by moralizing about all security research \(waste\). The fix is to pivot to defensive artifacts that help both researchers and defenders.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-15T09:58:36.332770+00:00— report_created — created