# Pwnbunny

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Merfere X](https://cerebralvalley.ai/u/merfere)
- **GitHub:** https://github.com/Wevenoticedanewlogin/289304892
- **Demo video:** https://github.com/Wevenoticedanewlogin/289304892/blob/main/demo/pwnbunny-demo.mp4
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4174

Pwnbunny is HackerOne's triage team as an agent: an autonomous, auditable bug-bounty triage platform. AI flooded the queue — the same models that help researchers find bugs let anyone generate plausible-looking reports at industrial scale — so Pwnbunny fights fire with fire: AI does the reading, with the guardrails humans would want.

Every report flows through an eight-stage pipeline: a prompt-injection screen (reporter text is fenced as untrusted data; attacks on the triager are quarantined and never auto-finalize), intake normalization, deterministic scope matching, dedupe (retrieval + LLM judge), a proof engine that parses curl PoCs out of reports and replays only unauthenticated idempotent in-scope requests (mutations gated behind one-click human approval), CVSS 3.1 scoring where the model proposes the vector and code computes the score, a deterministic decision, and an adversarial debate council — skeptic vs advocate on Muse Spark, judged by Muse Wonder — that every 'valid' verdict must survive. A per-company autonomy policy decides what auto-finalizes; humans approve, override, or reject from a live console. Every model call is persisted as an audit trace.

Measured, not vibes: on a 23-report labeled eval set, 22/23 (96%) decision agreement with human labels across two independent live runs, zero valid reports missed, and 2/2 live prompt-injection attacks quarantined.

## More from Meta Global AI Developer Hackathon

- [Eden](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4171)
- [ClearHire](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4172)
- [KRAI-A](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4173)
- [Ariana](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4175)
- [Trippie](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4176)
- [Mechanical Reviewer](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4177)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/4174. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt