Antibody

Antibody is a hackathon project building an autonomous agent that repairs a real SQL-injection flaw in a team-owned OWASP Juice Shop deployment (in routes/search.ts), verifies the fix doesn't break ordinary search, deploys the passing candidate to a live public endpoint, and publishes honest evidence — not just a PR or local demo. Core loop: Agent gets a real Semgrep finding → proposes a patch via Guild AI → host independently validates diff scope and runs locked-down behavior checks (search works, injection fails, scan is clean) → only a fully-passing candidate can deploy (host enforces this even if the agent asks to skip it) → external HTTP probes verify the live endpoint → everything logs to ClickHouse as evidence. A deliberately bad candidate is run through the same gate to prove rejection is real, not staged. Ethos: The docs obsessively close loopholes — no claiming a tool was "used" if only planned, no attributing test candidates to the model falsely, no calling deployment "verified" without an actual probe, no claiming the app is "secure" from a narrow test pass. The host owns credentials and authorization; the model only proposes.