CRITICAL
SQL injection in user lookup endpoint
Returns the full user table including PII for any unauthenticated request.
api-gatewayNew: Read our latest security research
AI adversary that maps, exploits, and secures your entire attack surface.
Antigen deploys AI pen testing agents against your production systems every night and pairs them with a monthly human red team assessment. Every finding is delivered with traces, reproduction steps, and remediation - directly in Github, Linear, or the Antigen Platform.
Nightly production scan
Evidence ready
Confirmed findings
Prioritized by exploitability
CRITICAL
SSRF in webhook handler allows internal network probing
api-gatewayCRITICAL
Auth bypass via JWT algorithm confusion
auth-serviceEvidenceExploit confirmed in production
GET /v2/users/lookup?id=1' OR '1'='1
200 OK · 312ms · 4,812 rows returned
[
{ "id": 1, "email": "ceo@acme-corp.com", "ssn": "***-**-1844" },
{ "id": 2, "email": "cfo@acme-corp.com", "ssn": "***-**-2901" },
{ "id": 3, "email": "vp.eng@acme-corp.com", "ssn": "***-**-3318" },
· 4,809 more records
]00:0002:1404:08
AGENT LOGagent-recon-7
02:14.382 probe /api/v2/users/lookup 02:14.401 → candidate: SQL injection via id param 02:14.456 → payload: 1' OR '1'='1 02:14.694 ✓ 200 OK · 4,812 rows · exploit confirmed 02:14.701 filing finding F-01 · severity: critical 02:14.812 synced to github.com/acme-corp/api/issues/4421
Single Operator Uses AI to Breach Nine Mexican Government Agencies
CEOs Rank Cyber Risk as the #1 Threat in 2026
Frontier AI Can Autonomously Discover Zero-Day Vulnerabilities
An AI System Now Outperforms Every Human Hacker
Continuous Security Monitoring Is Now a Federal Baseline
How Antigen protects you, every night and every month.
Continuous offensive security that combines nightly AI pen testing, monthly expert validation, and engineering-ready remediation evidence.
FINDINGS23ACTIVITY19 May 2026
CRITF-01SQL injection in user lookup endpointapi-gateway
CRITF-02SSRF in webhook handlerapi-gateway
HIGHF-03Authentication bypass via JWT algorithm confusionauth-service
HIGHF-04Hardcoded API key in payment servicepayment-api
Sync to GitHub⌘G
Assign to team member⌘A
View evidence⌘E
Suppress
Works with your stack.
Antigen maps and tests your entire attack surface across your infrastructure, cloud providers, and applications - from AWS to GCP, GitHub to Linear, Kubernetes to Vercel.
Visibility and prevention.
Know your surface and engineer proactively.
Attack surface mapping
See your entire infrastructure in a live, visual map - every service, endpoint, and dependency. Understand your full attack surface before an adversary does.
attack-surface·production
attack pathinternetPUBLIC ENTRY
api-gatewaySQL INJECTION
users-dbPII · TARGET
github-token
auth-service
billing-svc
×
Reachable from internetinternet → api-gateway → users-db · 3 hops
Shift left with SAST
A GitHub Action that runs static analysis on every pull request. Catch vulnerabilities before they reach production - directly in your workflow.
acme-corp/api-gateway·production
merge blocked82
app.get('/api/v2/users/lookup', (req, res) => {83
const { id } = req.query;84
db.query(`SELECT * FROM users WHERE id=$\{id}`)85
.then(rows => res.json(rows));86
});×
Antigen SecuritySQL injection · CWE-89 · 1 critical finding
Explore by industry.
Built for companies where security is trust.
Technology
For software teams shipping fast, deploying agents, and exposing new services every week.
Protect production APIsTest agent-accessible toolsValidate fixes before release
Financial Services
Continuous offensive testing for regulated environments where trust, auditability, and speed matter.
Map customer data exposureDocument evidence for auditorsPrioritize exploitable paths
Government
Independent validation for complex public-sector networks, vendors, and mission-critical systems.
Test internet-facing assetsSurface vendor risk pathsCoordinate responsible disclosure
We believe the security community gets stronger when vulnerabilities are found, verified, and disclosed responsibly.
Antigen conducts independent security research and responsibly discloses findings to affected organizations. We use that same adversarial discipline to protect customer environments every night.
Read our research