PoC verification pipeline

A CVE disclosure is a text description - "this parameter is unsanitized," "this endpoint lacks a nonce check." The fact that something can be exploited in the abstract doesn't say whether it has been successfully reproduced against a real WordPress install. We treat a CVE as unverified until the pipeline has stood up a clean WP, installed the plugin at the vulnerable version, walked through the exploit with a real browser, and recorded the impact.

The pipeline runs two models in a cascade. A fast, cheap, lightweight LLM tries first; if it can't land the exploit cleanly, a stronger frontier LLM picks up on the same environment and gets a second attempt. The same class of strong model then reviews the tool-call log and issues an independent verdict - so a successful run isn't marked "failed" by a weaker judge the way a weaker judge is prone to do when tie-breaking its own decisions.

The output of a successful verification is an artifact, not a message. A YouTube video of the exploit, a Playwright trace you can step through request-by-request, a standalone exploit script you can re-run, and the exact vulnerable code snippet with the fix diff - all produced from the same reproduction session.

Stateful exploit chains. A vulnerability that requires three users interacting across two pages and a cron job to land can sometimes be reproduced by a model with a 40-turn budget, but often can't. These fall back to static analysis - we still score the plugin, still flag the CVE, we just don't ship a video.

WAF / hardening dependent. Some exploits are interesting specifically because they evade a popular WAF rule. Reproducing them against a bare Docker-WordPress with no WAF either succeeds trivially (not a useful signal) or fails mysteriously (the WAF isn't there to evade). We don't simulate arbitrary production hardening.

Race conditions. TOCTOU, check-then-use, and timing side-channel exploits reproduce non-deterministically. A single agent run either happens to hit the window or doesn't; I don't currently re-run enough times to establish statistical confidence. Honest label in those cases: "research_complete, poc_pending".