IronCurtain: Secure AI Agent Runtime

What it is

The post is by the engineer who committed the OpenBSD TCP SACK implementation — and its bug — in November 1998, now using his own IronCurtain framework's vuln-discovery workflow to re-find it and to surface fresh zero-days. The framing target is Anthropic's "Mythos Preview" model, whose Red Team publicized the SACK bug as a frontier-only finding; the author's counter-claim is that the capability lives in the orchestration harness, not the model.

How it works

The workflow is a YAML-defined finite-state machine. A central Orchestrator agent acts as a router that never reads the target source itself — it decides which specialist to dispatch (analyst, fuzzer, PoC builder) purely from an append-only execution journal. Journal plus on-disk artifacts let every agent start with a fresh context window and rehydrate from disk. The discipline is "hypothesize statically, validate by execution": a PoC must be an executable harness that triggers memory corruption. Harness building is tiered — single-function isolation fuzzing, multi-component harnesses, then full QEMU/VM validation — and the workflow scales up tiers only as needed.

Preconditions / Affected

Practical facts for anyone considering this:

• Token cost is high. ~10M tokens for one run on a moderately sized codebase: $150 on Opus 4.6, $30 on Sonnet 4.6. Five GLM 5.1 runs averaged 27M tokens each (more iterations), landing near Sonnet cost at Z.AI's rates ($1.40/M input, $0.26 cached, $4.40/M output).
• Local inference is not demonstrated. A distilled candidate (Qwen 3.5 distilled) could not run the workflow; GLM 5.1 ran on Z.AI's hosted GPUs throughout.
• The secure IronCurtain container cannot natively boot an OpenBSD VM, which is why early runs fell back to static-only analysis.

What to do

Nothing to patch here — this is a capability/tooling signal. If you maintain heavily-fuzzed C/C++ code, note that the SACK trigger was a difference of two sequence numbers out of 4.3 billion, sitting exactly on the 32-bit signed boundary — the kind of edge a single-function sweep finds in seconds but review misses. The workflow claims previously-unreported bugs in four widely-used, years-fuzzed OSS projects.

Caveats

• The four new findings are unverified externally: identities and bug mechanics are withheld pending upstream coordination, CVE assignment, and advisories. The page's excerpt cuts off mid-sentence in the first case study ("a widely-deployed media frame…").
• The OpenBSD replication that produced a working PoC used Opus 4.6 via Claude Code with manual steering, not the autonomous workflow. Prompt/journal fixes made later runs autonomous, per the author — but the marquee replication itself was hand-guided.