Cyber Bug Bounty Agent
Autonomous security-research pipeline: eight Claude agents across two LangGraph state graphs.
What it does
A multi-agent system that runs the whole bug-bounty loop without a human in the middle. One graph handles intake — research the target, write the outreach, wait for permission. A second graph runs after approval: recon, scan, aggregate and validate the findings, generate the report, deliver it. A permission watcher polls for the reply that moves a target from the first graph to the second.
Architecture
Two LangGraph state graphs and a watcher, coordinated by a supervisor. Intake runs on the start command and stops atwaiting; the scan graph runs once permission comes back.
┌─────────────────────────────────────────────────────────────────────┐
│ SUPERVISOR (Orchestrator) │
│ Builds & runs two LangGraph StateGraphs + watcher │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ INTAKE GRAPH (start command) SCAN GRAPH (after approval) │
│ ┌──────────────────────┐ ┌──────────────────────────┐ │
│ │ START │ │ START │ │
│ │ ↓ │ │ ↓ │ │
│ │ ResearcherAgent │ │ ReconAgent │ │
│ │ ↓ │ │ ↓ │ │
│ │ OutreachAgent │ │ ScannerAgent │ │
│ │ ↓ │ │ ↓ │ │
│ │ END (status=waiting) │ │ AggregatorAgent (Opus) │ │
│ └──────────────────────┘ │ ↓ │ │
│ │ ReporterAgent │ │
│ PERMISSION WATCHER (watch command) │ ↓ │ │
│ ┌──────────────────────┐ │ DeliveryAgent │ │
│ │ Poll IMAP every N min│ │ ↓ │ │
│ │ ↓ │ │ END (status=delivered) │ │
│ │ ClassifierAgent │ └──────────────────────────┘ │
│ │ ↓ │ │
│ │ Route: granted → │ │
│ │ approve / auto-scan│ │
│ └──────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘Agent roles
| Agent | Model | Purpose |
|---|---|---|
| ResearcherAgent | Claude Sonnet | OSINT gathering + company profiling |
| OutreachAgent | Claude Sonnet | Personalised email generation |
| ClassifierAgent | Claude Haiku | Reply classification (granted / denied / ambiguous) |
| ReconAgent | Claude Sonnet | Attack-surface analysis from recon tool output |
| ScannerAgent | — | Orchestrates the vulnerability scanning tools |
| AggregatorAgent | Claude Opus | Deduplicates, validates and CVSS-enriches all findings |
| ReporterAgent | — | Generates the PDF report via ReportLab |
| DeliveryAgent | Claude Sonnet | Writes the delivery cover note |
Core infrastructure
| Module | Purpose |
|---|---|
| TokenAwareClient | Wraps every Anthropic API call with cost tracking, retry logic and network resilience |
| StageManager | RAM-aware sequential execution with GC, monitoring and emergency process kill |
| NetworkManager | Detects connectivity drops, waits for VPN restoration, retries operations |
| DatabaseManager | SQLite persistence — WAL mode, connection-per-call, parameterised queries |
| Notifier | ntfy.sh push notifications for every pipeline event |
| EmailSender | SMTP via Resend, which avoids Cloudflare blocking on VPN IPs |
| IMAPReceiver | Gmail IMAP polling for permission replies, via ImprovMX forwarding |
Built with
- Python
- LangGraph
- Claude API
- Multi-agent
- Security
- SQLite
Get it
The story behind it
This page covers how it is built. For what it does, why it exists and what it found, read the Cyber Agent case study.
Need something like this built for you?
We build production AI systems and developer tooling for clients, delivered end to end and handed over to your own accounts.