We ran an AI agent against our own dependency tree. It found a PII leak in 10 minutes. Then it stopped. Here's why.

Описание и применение

BugTraceAI быстро обнаружил утечку PII в открытом проекте Wallos и, следуя своему чарту, остановился, не переходя к дальнейшему эксплоиту, демонстрируя баланс между обнаружением и управлением рисками.

Задача

Detecting and handling PII leaks in open‑source projects while preventing unintended exploitation by an AI security scanner.

Результат

BugTraceAI quickly identified a real PII leak in a self‑hosted Wallos instance and, following its charter, stopped before escalating the issue, demonstrating a balance between detection and liability management.

Рабочий процесс

• Point BugTraceAI at the target infrastructure
• Run the scan for 10 minutes
• Agent surfaces a potential PII leak
• Agent validates the finding by reproducing the disclosure
• Agent stops further investigation per its charter
• Human reviewer receives the validated finding
• Authors disclose the issue to the Wallos maintainer (CVE‑2026‑2747)
• No further exploitation chain is pursued

Доказательства

Ten minutes in, it surfaced something real: a self‑hosted Wallos instance (open‑source subscription tracker) exposing subscriber PII through an unauthenticated endpoint. Validated. Reproducible.

Источник

Then the agent did something we're actually proud of: it stopped.

Источник

Its charter said: validate the finding, then hand it to a human.

Источник