Nothing is true until it replays
Warden points an autonomous agent at one target, lets it propose vulnerabilities, and then re-runs every claim in a clean capsule. What comes back is not what a model was confident about. It is what survived.
- No LLM anywhere in the verification path
- Every verdict carries a negative control
- What it could not prove is in the report too
round 14 · exploit · 4 submissions
- h-9f21 critical queued
Voucher double-credit: eight redeem lanes race one balance write
- POST /auth/session
- POST /wallet/redeem ×8, overlapped
- GET /wallet/balance
- h-3c47 critical queued
Sanitizer bypass: nested <svg><style> survives the comment filter
- POST /posts/{id}/comments
- mXSS re-parse in the moderation view
- GET /admin/moderation
- h-b8d0 high queued
SSRF chain: the avatar importer follows a 302 to the metadata service
- PUT /profile/avatar?src=
- 302 → 169.254.169.254
- PUT /latest/api/token
- h-5e13 high queued
Second-order SQLi: display_name reaches the nightly digest query
- PATCH /profile
- digest job drain
- GET /digest/preview
0 confirmed 0 refuted 0 false positive
- confirmed
- Replayed. The oracle held on the exploit value and failed on the control.
- refuted
- Replayed, did not reproduce, never asserted. A question that got answered.
- false positive
- Asserted, and it did not reproduce. Written down as one, not as a finding.
- open
- Submitted. The harness has not ruled on it yet.
- unverified
- Static mode. There was never anything to replay.
How a run
actually
works
Four phases. The agent holds the pen for exactly one of them.
An autonomous agent that both finds and grades its own work is a confident narrator, not a test. Warden splits the two: the model proposes, and a harness with no model in it decides what survived.
01
Recon
harness records · agent directs
Before anything is attacked, the target is mapped. The harness watches every request the agent makes and builds its own inventory of routes, parameters and auth states — then the agent goes hunting for the ones nothing links to, which is where most real defects live.
The map belongs to the harness, not to the model. That is what makes coverage a number worth quoting later.
02
Exploit
agent proposes
The agent works one family of defect at a time — injection sinks, authorization boundaries, parsers, client-side sinks — several in parallel, each chasing a different hypothesis against the same map. Anything promising is written up as a candidate with the exact request chain that produced it.
Candidates land on a shelf, not in your report. Nothing the agent believes has reached you yet.
03
Verification
harness only — no model
The harness takes the pen. Each candidate is re-run from a clean baseline, twice: once bound to the value that is supposed to break it and once to a control that is not. It holds for one and fails for the other, or it does not become a finding.
No language model is consulted anywhere in this step. It is the reason a finding here means something.
04
Reporting
harness writes
Every confirmed finding gets its own document carrying the chain that proved it and the control it was held against. The claims that failed replay get their own file, with the reason. So does everything the run submitted and never settled.
And a coverage list: what was looked at, what was clean, and what nobody reached.
Found in
the wild.
Not in a
benchmark.
Real projects, real maintainers, and a link on every claim so you can check it yourself.
Nothing appears in this section that a reader cannot verify by following a link in it. That is the only reason it is allowed on the page.
One disclosure is public today. The rest arrive here as maintainers answer them.
TryGhost/Ghost 6.21
Editor-to-Owner privilege escalation in Ghost Admin
A four-link chain let an editor-tier account persist markup that executed in the admin session of every Owner and Administrator who opened Ghost Admin — crossing a role boundary Ghost enforces server-side, and surviving deletion of the account that planted it.
Fixed upstream
- Severity
- high· CVSS 8.7
- Model driven
- DeepSeek V4 Flash
- Disclosed
- August 2026
CVSS is self-assessed. Severity is the harness’s reading of what the replay actually demonstrated, not the model’s reading of what it wrote.
1 claim.
2 replays.
0 opinions.
A submission the harness will rule on carries three things.
A chain it can re-run, the predicate that chain asserts, and a control. Missing any one of them it is not replayable, and it is refused before anything boots. No model is consulted at any point below.
The chain Replayed exactly, in order, against a freshly booted copy of the target.
- POST /auth/session
- POST /wallet/redeem ×8, overlapped
- GET /wallet/balance
The oracle The predicate the harness re-runs. Not the model’s account of what happened, and not a diff of two screenshots.
oracle
balance credited twice for a single-use voucher
The control The agent supplies two values, never two requests. The harness replays the identical chain bound to each.
control
the identical chain with the lanes not overlapped: credited once
The verdict It held for the exploit value and failed for the control. A finding exists only when both halves are true — one alone is a coincidence.
Every verification boots its own capsule, and the loop never mutates the target — so a second replay from the same clean baseline is provably identical, and settled hypotheses are never re-run. Blind classes (SSRF, blind RCE, XXE, blind SQLi, browser-executed XSS) are proved instead by a canary: the harness issues a nonce the agent never learns and waits for a callback on its own listener.
It reproduced.
It’s in the
report
Not that a model was sure. Not that a signature matched.
The harness re-ran the chain against a copy of the target nothing had touched, the assertion held for the exploit value, and it failed for the control. Both halves, or it does not become a finding.
What you get is a directory
Every run writes its own audit trail as it goes. Each confirmed finding gets its own document carrying the chain that proved it, the assertion the harness re-ran, and the control it was held against — so a reviewer can re-run it without asking you how.
report.md is the client-facing document and summary.md is the harness’s own. They are
deliberately separate: a disagreement between them is a finding about
the run.
~/.warden/runs/<id>/
report.mdthe client documentreport/index.mdwhat ran, and against whatreport/<finding>.mdone per confirmed findingreport/claims-refused.mdwhat did not reproducereport/still-open.mdwhat the run never settledsummary.mdthe harness’s own accountfindings/one file per hypothesis, ruled on or notrounds/round-NN-role.mdwritten as each round endsevents.jsonlappend-only, one JSON object per line
It didn’t.
You still
get told.
The misses are not deleted, and they are not padded into the count.
Every claim the harness replayed and could not reproduce is written down, in its own file, with the reason it failed. So is everything the run submitted and never got to. Nothing is quietly dropped on the way to a number you would have had to trust.
the agent asserted it
False positive
Submitted as a real finding, replayed, and it did not hold. It lands in claims-refused.md under its own name, with the
reason from a closed set — a malformed artifact reads differently from an
experiment that was simply run and settled.
the agent proposed it
Refuted
Same replay, same failure, but it was never asserted — so it reads as a question that got answered rather than a mistake. Testing something you might be wrong about is never discouraged here, which is why the list of things ruled out is worth reading.
And the run tells you what it did not look at. The harness seeds a worklist from its own instrumented surface — (endpoint, parameter, class) for a live run, (file, family) for a source one — and the agent closes each item with an outcome. That is what makes “nobody looked at this” distinguishable from “someone looked and it was clean”, and it is a denominator the model does not get to author.
Round 30 is
as sharp as
round 2
A run accumulates. A round is thrown away.
Every round gets a brand-new worker process and a brand-new model session. Nothing from the previous round’s transcript carries over. What crosses the boundary is data the harness owns — so round 8 is built from the state round 7 produced, not from round 7’s context window.
- 01 The router picks the role for this round.
- 02 The harness builds the brief from its own state — never from the last transcript.
- 03 One worker process, one model session, N subagents fanned out over lenses.
- 04 Subagents propose onto a draft shelf. None of them can submit.
- 05 The orchestrating session reviews the shelf and submits what survives it.
- 06 The harness replays every submission and rules on it.
- 07 Failures compile into rules that are carried into the next brief.
Crosses the boundary
- the findings ledger
- the surface graph
- rules compiled from past failures
- the open worklist
- a recovery note, if the last round was stopped
Does not
- the transcript
- the model session
- the worker process
- every belief the harness rejected
This is the deliberate hard reset. No round’s context grows without bound, the model cannot quietly carry forward a belief the harness rejected, and a round that hangs costs you that round rather than the run. The practical consequence: round count is not progress.
What you
hand it decides
what it can prove
Mode is not a setting. It falls out of the composition.
And mode then decides almost everything else — whether claims can be replayed at all, what the scope guard permits, which role runs, and how findings are reported.
What that buys
Replayed in place, black box.
The agent works the host the way an attacker would, and every claim it makes is re-run against that same host before it becomes a finding. A verdict is a statement about the target as it stood — a weaker statement than a clean-baseline one, and the report says so rather than glossing it.
Evidence ceiling
Proof, replayed in place
Needs an authorized-host list and a recorded operator attestation.
One run, one target. For several origins, start a run per origin — each is re-validated through the full authorization gate, so it is not a way around one, and each gets its own map of the surface, its own coverage list and its own verifier.
Pay for runs,
not seats
Annual billing at 15% off. Cancel anytime.
Isolated machines and model time are included. One key, one bill, no capacity to provision and no second vendor to reconcile — the number beside the plan is the number.
Starter
$199/mo
- 1 app assessment / month
- 1 repository scan / day
- Email support
Growth
most picked$499/mo
- 5 app assessments / week
- 5 repository scans / day
- Priority support
- Slack integration
Enterprise
$1,000+/mo
Custom pricing · multi-year contracts
- Unlimited scale
- Dedicated isolated capacity
- SLA · dedicated support
- Compliance exports
Every plan runs the same harness. No plan verifies a claim more carefully than another one — replay is the product, not an upsell.
Point it at
something.
See what
survives
export WARDEN_API_KEY=wk_live_…That is the whole setup. Give a run a target, pick how hard to look, and read what came back — there is nothing to install, nothing to keep running, and no machine of yours involved at any point.
What you don’t have to bring
- Infrastructure
- Every target, agent and verifier gets its own isolated machine, provisioned for the run and destroyed after it. Each verification boots a fresh one, which is what makes a clean-baseline replay possible at all.
- A model
- The agent’s model is ours to choose, pay for and swap as better ones land. No key of yours, no rate limit of yours, and no token bill to reconcile against a run you have already been quoted for.
- The tooling
- Route discovery, fuzzing, template scanning and a scripted browser are already inside the machine the agent works from — with the wordlists that decide whether it ever sees the routes nothing links to.