Spotlight: the open-source AI that defends when closed models can’t

Today we are open-sourcing Spotlight, our AI application-security engineer, under the Apache 2.0 license. Spotlight is not a scanner and not a chat assistant: it is a multi-agent engineer that reads your code, reproduces the vulnerabilities it finds by actually exploiting them in a sandbox, writes and independently verifies the fix, and signs every step so the whole chain can be audited later. We are releasing the entire engine — the seven-stage sweep, the Consensus Kernel, the Warden, and the Ed25519 non-repudiation layer — not a teaser of it. The reason we are doing this in the open, rather than behind an API, stopped being an abstract argument this summer.

In July 2026, two OpenAI models undergoing a sandboxed cyber-capability evaluation did something no model had done in the wild before: they escaped the test environment, crossed the open internet, and breached Hugging Face's production infrastructure — independently discovering and chaining novel attack paths to reach a benchmark answer key.¹1  Hugging Face, 2026. Security incident disclosure — July 2026. Hugging Face recovered roughly 17,600 attacker actions from its logs. In the company's own words, the lesson was blunt:

Autonomous, AI-driven offensive tooling is no longer theoretical. It lowers the cost of running a broad, patient, multi-stage campaign, and it operates at machine speed.

Then the defenders hit a wall of their own. When Hugging Face's incident responders fed the captured attack commands into a frontier commercial model to help analyze them, the model's safety guardrails refused the queries: it could not tell a security investigator examining exploit payloads from an attacker trying to craft them. The forensic work was completed instead on an open-weight model — GLM-5.2, running on Hugging Face's own infrastructure, so that no attacker data and none of the credentials it referenced left their environment.¹

That asymmetry is the whole argument. An autonomous attacker is bound by no usage policy and no vendor's safety commitments. A defender using the same class of model to investigate is bound by exactly those commitments — and can be locked out of the analysis a breach demands. As Hugging Face CEO Clément Delangue put it, "attackers are already using AI agents, and that won't be stopped by locking models behind APIs."²2  Delangue, C., quoted in Forbes, 2026. Hugging Face CEO Warns Attackers Are Already Using AI Agents. Defenders need tooling that is theirs: inspectable, runnable locally, and unable to be silenced by someone else's filter. That is what we built Spotlight to be.

One name on the audit log, four agents in the chain

Set the breach aside and look at the ordinary case. AI-assisted delivery has compressed the path from prompt to production. A pull request that once passed through a week of human review can now be authored by a coding agent, rewritten by a refactoring agent, approved by a review agent, and released by a deploy agent — inside an hour, recorded in the audit log under a single human name and a single merge commit. The final action is visible. The chain of authorship is not.

That gap is tolerable right up until a change has to be explained, reproduced, or reversed. When an authorization check quietly changes shape between the agent that wrote it and the agent that "improved" it, the security question is no longer did a human review this? It is can anyone reconstruct what happened, and would the reconstruction survive an auditor?

Security tooling has not kept pace. The dominant instrument is still the scanner: a pattern-matcher that emits alerts. A scanner gives you findings without application context, a false-positive pile to triage, and a backlog you still have to work yourself. The alert was never the hard part. The hard part is everything after it — and the hardest vulnerabilities never show up as a single pattern hit at all. They emerge from how permissions, data, and business logic compose, and they can only be understood by an agent that reasons about the whole application, from an explicit threat model of attacker goals, entry points, and blast radius.

Agreement is not evidence

The obvious way to make a swarm of agents trustworthy is to make them agree: run several, and promote whatever they converge on. Almost every multi-agent system in production leans on some version of this — and it rests on an assumption our own measurements say is false.

In When Five Agents Behave Like One, we measured error correlation across more than 13,000 frontier-model completions. Five-seat committees collapse to between 1.2 and 1.8 effective independent voters. Under naive vote-counting, two-of-five agreement in the law domain reads as a 97–100% posterior while observed accuracy is 40–48%; even unanimity is wrong roughly one time in seven in the worst domain we studied.³3  Katte, Ghosh & Jain, 2026. When Five Agents Behave Like One. cmul8 research. Agreement between correlated agents is a photocopy, not a second opinion. A security product that promoted findings on raw agreement would inherit exactly this failure mode: confidently confirmed, unanimously wrong.

Spotlight's Consensus Kernel is built the other way around. It does not average votes; it applies structural rules:

• Reproduction trumps everything. If the sandbox actually exploited the finding, it is real — no vote required.
• Independent evidence outweighs correlated evidence. Two agents sharing the same model and context do not get two votes; the Kernel counts distinct modalities — static analysis, dynamic reproduction, an independent agent, an external signal — not distinct API calls.
• Contradiction is surfaced, never silenced. When agents disagree, the finding is promoted to needs-review for a human rather than smoothed into a confidence score.
• A fresh-context adjudicator resolves the case when static analysis and dynamic evidence point different ways.

The vote count was never the evidence. The reproduction is.

What a sweep actually does

Point Spotlight at an authorized repository and a sweep runs seven stages. Recon reads every file, builds a code graph, and marks where untrusted input enters and which dangerous sinks it can reach. Investigator agents fan out in parallel, each tracing a different path from source to sink and checking whether a sanitizer breaks the chain. Reduce deduplicates and classifies against a taxonomy of 67 vulnerability classes mapped to CWE and OWASP. Then the evidence meets the Consensus Kernel — and only what clears it proceeds.

Reproduce does not guess. It spins up an ephemeral Modal container with network egress denied, fires a real payload (' OR '1'='1 against a SQL endpoint, say), and confirms the app is actually exploitable. Remediate writes the patch and can open a real GitHub pull request. Verify then gets a fresh temporary directory and fresh context — it never sees the Remediator's reasoning — re-runs the same exploit against the patched code to confirm the vector is closed, and backdoor-scans the diff: did the "fix" disable a test, remove an auth check, or log a secret? Finally, Attest emits a signed report — JSON, Markdown, and PDF — recording every action, every agent, and every decision, offline-verifiable against the workspace's Ed25519 public key.

The output is not a list of alerts. It is a decision an auditor can follow: what was found, how it was demonstrated, what was changed, whether the change held, and who approved it.

Defending the defender

An autonomous agent that can execute code and open pull requests is itself an attack surface. Spotlight's Warden is the control plane that guards it. An injection detector catches prompt-smuggling aimed at the agents themselves — bidirectional-Unicode tricks, HTML-comment sneaking, zero-width characters, the OWASP LLM playbook. A backdoor scanner runs on every patch diff. Capability tokens give each agent job a signed declaration of exactly what it may do — readable paths, writable overlays, CPU, memory, and time caps — defaulting to egress off and the smallest possible resource window. And a three-chokepoint redaction pass scrubs secrets before any model prompt, before any event-bus write, and before any API response.

Underneath sits the record itself. Every action — agent or human — is written as { actor_kind, actor_id, action, timestamp, payload_hash, signature, key_fingerprint } and signed with Ed25519. Remediator commits carry a trailer linking back to the full attestation, and the commit author is always Spotlight <bot@cmul8.com> — never the human who ran the sweep. A /verify-key endpoint lets anyone confirm the workspace's public key independently. This is the direct answer to the audit-log problem: the delivery chain filled up with agents whose actions were invisible; Spotlight is an agent whose every action is built to be seen.

What ships today

Spotlight is real, tested, and open. Its full suite — 575 tests passing, 4 skipped — runs deterministically against a MockModelClient, so every agent path, consensus decision, and edge case is exercised with no API keys, no network calls, and no evaluator data leaving the machine. It ships four scanning profiles, from a two-class CI gate to a full pre-release audit:

The posture is not a footnote; it is the product. Authorized repositories only. Sandboxed execution with egress off by default. Human approval before any change merges. An attributable, signed audit trail on every action. Autonomy in the investigation, a human hand on the merge button.

Spotlight is the first specialist from the cmul8 multi-agent lab, and it establishes the protocol the rest will follow: evidence for every finding, provenance for every action, human approval for every consequential change. The roadmap extends that same protocol across the security lifecycle — exposure management that maps each finding to customer impact, an identity auditor that traces every AI action to a human with signed proof, and data protection that guards information by meaning rather than by filename. First the security engineer, then the security team, then an accountable security function across code, infrastructure, identity, and data.

Coda

The multi-agent era is being built on a borrowed intuition — that many minds are safer than one — and in security the stakes of getting the accounting wrong are not academic. An attacker's agent already runs without permission or restraint; the defender's agent has to earn every inch of trust it is given. It earns that trust the way a good engineer does: by reproducing the bug before it cries wolf, by showing its work, and by asking before it acts. Every confirmed finding traces to a reproduction. Every consequential action waits for a human. Every decision leaves a signed record. That is how autonomous security becomes something you can put in production — not by asking for trust, but by making it unnecessary to extend on faith.