How we run swarms of AI hacking agents against ourselves in a game of capture the flag

Lovable has developed an internal offensive security program using swarms of AI agents to identify real vulnerabilities within their systems by simulating human-like attacks. These agents, guided by a capture-the-flag methodology, find and verify vulnerabilities by retrieving flags from systems, ensuring a deterministic proof rather than relying on speculative models. This approach allows Lovable's AppSec team to focus on critical issues while offensive security researchers can work more efficiently, as the agents handle preliminary tasks. The program emphasizes maximizing the attack surface and minimizing attack distance, providing agents broad access to Lovable's product surfaces through dedicated APIs. Despite the capabilities of these agents, human coordination and expertise remain essential for effective and cost-efficient operations. While this agent-based hacking approach is not entirely new, it remains challenging to commoditize, requiring custom in-house development tailored to specific system architectures and trust boundaries.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.