We mostly write here about how autonomous testing works, and where it stops. This one is a field note: the same agent harness we run against customers' own apps, pointed for the first time at a live program on Intigriti, a public bug bounty platform. The program was Odoo's. On its first day, the harness found and proved a remote code execution (RCE) bug. The program rated it exceptional and paid a €3,000 bounty. The payout is public on our researcher profile.
We are writing it down because it is the honest test of the whole idea. Inside a customer's workspace the agent is told what to look at. A public program is a cold target with real researchers already on it, a scope document, and no hints. If the approach only works when we choose the target, it does not really work.
What it found
A remote code execution bug in an asset that was in scope for Odoo's program, reachable from the internet. The harness built the request that proved it and kept the result only once it had the server's response to show for it. We are leaving the technical details out of this post.
Why this is the part that matters
A scanner can flag that something is reachable. That is a lead. The gap between reachable and exploitable is where most "potential criticals" quietly die as false positives, and it is the gap the agent has to cross on its own to earn a rating like this one. The bounty is a proof that held up to someone else's review, on a target we did not pick.
What we are taking from it
One finding is one finding. It does not tell us the agent is better than the researchers who work these programs every day, and we are not going to pretend it does. What it tells us is narrower and more useful: the loop that finds proven bugs in a customer's app finds them in the wild too, against a scope it has never seen, with the proof standing up to an external reviewer.
We will keep running it on public programs, and we will keep writing the results down here, the quiet days as well as this one. If you want the same loop pointed at your own app instead of a cold target, that is what Vulnix is: a pentest that ends with a working exploit, not a list of maybes.
