How We Use /goal to Find Bugs in Patch the Planet

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.trailofbits.com/2026/07/28/how-we-use-goal-to-find-bugs-in-patch-the-planet
• Blog Title: How We Use /goal to Find Bugs in Patch the Planet
• Suggested Section: AI Security > AI Assisted Fuzzing And Vulnerability Discovery, with cross-references to Pentesting Web > Source Code Review / SAST Tools and Generic Methodologies & Resources > Fuzzing Methodology

🎯 Content Summary

Trail of Bits explains how it uses Codex goal-based prompting, referred to as /goal, to automate vulnerability discovery in large, heavily audited open-source projects during the joint Trail of Bits and OpenAI Patch the Planet initiative. A goal gives Codex an open-ended objective and allows it to work autonomously until it reaches a defined success condition. The post is a technical methodology for AI-assisted auditing rathe...

🔧 Technical Details

Self-generated, adversarially reviewed audit goals: Provide an autonomous security agent with the repository context, desired vulnerability class, and a structured threat model, then have it generate its own measurable research goal. Before execution, require the agent to identify how another model could satisfy the wording lazily, superficially, or through invalid assumptions and revise the criteria accordingly. The resulting goal should explicitly define attacker-controlled inputs, trust boundaries, impact, prohibited prerequisites, evidence requirements, duplicate checks, persistence, output location, and stopping condition. Measure actual source inspection with tooling such as aicov, which records which source lines the agent has read.

Outcome-focused vulnerability discovery: Specify what a reportable vulnerability must achieve, but avoid forcing a particular investigation path. For r...

🤖 Agent Actions

Done.

Updated:

• src/AI/AI-Assisted-Fuzzing-and-Vulnerability-Discovery.md

Added concise, non-duplicative technical content covering:

• self-generated and red-teamed /goal-style audit goals
• outcome-focused prompting with explicit attacker/prerequisite constraints
• one-outcome-per-agent orchestration
• differential Semgrep validation against vulnerable vs patched revisions
• multi-stage AI finding validation (skip / no_variant / bug_found, multi-judge, human dedupe)

Also added the Trail of Bits blog URL to the file’s ## References.

Verification:

• checked the diff
• confirmed all new relative links resolve
• mdbook build could not be run because mdbook is not installed in this environment

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.trailofbits.com/2026/07/28/how-we-use-goal-to-find-bugs-in-patch-the-planet

Content Categories: Based on the analysis, this content was categorized under "AI Security > AI Assisted Fuzzing And Vulnerability Discovery, with cross-references to Pentesting Web > Source Code Review / SAST Tools and Generic Methodologies & Resources > Fuzzing Methodology".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0