Author: HM Shihabuddin Jashory (Shihab)
GitHub: @jashory | ORCID / Research DOI: 10.5281/zenodo.23832719
Canonical Gist: 8-Layer-Agentic-Architecture-NASA-Google-Case-Study.md
Most automated security scanners drown maintainers in theoretical alerts and false positives. Over the past year, I designed and deployed an 8-Layer Autonomous Agentic Security Architecture (DOI: 10.5281/zenodo.23832719) built around a simple premise: every security patch is a map to the bugs that were missed right next to it.
By combining a 4-Tier Multi-Agent Verification Hierarchy with a specialized Sibling Patch-Gap Engine, this architecture systematically audited mission-critical open-source infrastructure—resulting in:
nasa/fprime) spacecraft flight software framework PR #6299``@bitWarrior from GHSA-pq8v-c63j-wv29`` P2 triaged disclosures in Google Vulnerability Reward Program (Google VRP) Issue #580130935 and Issue #580032520, among 10 active Google VRP disclosures). GHSA / VDP) nasa/fprime-gds, nasa/CryptoLib, nasa/spacewasm, nasa/openmct, nasa/earthdata-search, nasa/harmony), the Space Telescope Science Institute ( spacetelescope/jwql for the James Webb Space Telescope), Google (google/adk-*, google-gemini/gemini-cli, googleapis/mcp-toolbox, cdapio/cdap, genkit-ai/genkit, firebase/firebase-tools, google/osv-scalibr, angular/angular-cli, google/oss-fuzz), Bazel ( bazelbuild/bazel-central-registry), ChromeDevTools ( ChromeDevTools/chrome-devtools-mcp), Anthropic ( modelcontextprotocol/inspector, modelcontextprotocol/servers), and Cloudflare ( cloudflare/workers-sdk).
Here is an inside look at the architecture, why Sibling Patch-Gap Analysis works so reliably on hardened codebases, and how multi-agent verification eliminates the "AI slop" crisis in security research.
Traditional SAST tools rely on fixed syntactic rules. When they scan a million-line C++ flight software repository or a distributed TypeScript cloud SDK, they flag thousands of low-impact patterns while completely missing domain-specific trust boundary violations.
Conversely, first-generation LLM bug-hunting scripts hallucinate attack paths that cannot actually execute because they never compile the target, never inspect runtime state, and never verify whether an upstream reverse proxy or caller already sanitizes the input.
When I architected the 8-Layer Autonomous Agentic Security Architecture (DOI: 10.5281/zenodo.23832719), I enforced two strict engineering invariants:
git diff remediation patch.Worker -> Supervisor -> Chief Auditor -> Tier-0 System Integrator)
+-------------------------------------------------------------------------+
| Tier-0: System Integrator (SI) |
| Final cross-check of source code, benign PoC output, and git diff patch |
+-------------------------------------------------------------------------+
^
|
+-------------------------------------------------------------------------+
| Tier-1: Chief Auditor |
| Adversarial review: attempts to disprove exploitability & check guards |
+-------------------------------------------------------------------------+
^
|
+-------------------------------------------------------------------------+
| Tier-2: Supervisor Agent |
| Orchestrates target scope, CWE taxonomy, and sibling commit graph audit |
+-------------------------------------------------------------------------+
^
|
+-------------------------------------------------------------------------+
| Tier-3: Specialized Worker Agents |
| Shallow clone, AST/dataflow trace, benign local harness & patch builder |
+-------------------------------------------------------------------------+
When a security team patches a vulnerability (CVE or GHSA), human engineers naturally focus on the exact file, function, or branch reported in the advisory. However, large engineering repositories rarely implement a pattern only once:
filepath.Rel() or Path.resolve() in one handler, a sibling handler—or a v2 rewrite branch—often misses the edge case (such as trailing separator absence, Windows volume-relative paths, or Git worktree alternates).
Instead of scanning codebases blindly from scratch, the engine executes a 4-stage loop:
CVE) and hardening commits ( fix(security):, Harden ..., Validate ..., Escape ...) across target repositories. target.startswith(base_dir)
Path(target).resolve().is_relative_to(Path(base_dir).resolve())
execFileSync, os.Open, git.Repo, fetch redirect handlers).
F´ (F Prime) is NASA Jet Propulsion Laboratory's (JPL) flight-proven software framework used for spacecraft, CubeSats, and instruments (including the Mars Helicopter Ingenuity heritage ecosystem).
In earlier security hardening (PR #5320 and PR #5850), NASA introduced Os::SandboxedFile to enforce strict directory containment for flight file operations across components such as Svc/FileUplink, Svc/FileDownlink, and Svc/FileManager.
CWE-22 — Missing Os::SandboxedFile in Svc/CmdSequencer)
Using the Sibling Patch-Gap Engine, our architecture mapped every component in nasa/fprime that opens flight files by path and compared their Os::File declarations against the Os::SandboxedFile migration:
FileUplink, FileDownlink, and FileManager had been migrated to Svc/CmdSequencer/FPrimeSequence.hpp:237 and Svc/CmdSequencer/FPrimeSequence.cpp:373-449) still instantiated a raw, unsandboxed Os::File m_sequenceFile;. CmdSequencerImpl::validate / CS_VALIDATE / CS_RUN) bypassed the We reported the root cause along with a clean, flight-code-compliant remediation patch via GitHub Private Vulnerability Reporting (GHSA-pq8v-c63j-wv29).
CmdSequencer had been missed during the Update CmdSequencer's FPrimeSequence to use Os::SandboxedFile)
Following that validation, our engine expanded across NASA's broader flight and ground-data software portfolio, submitting verified defensive reports with ready-to-merge patches for:
GHSA-rm58-f49w-5c3g) GHSA-pfm4-7hrj-24jp) GHSA-3p2g-79q9-39cr) GHSA-mhv6-5g6q-c4jg) Issue #2111) Issue #995) Issue #1809)
As AI agent protocols (MCP / Model Context Protocol) and cloud CLIs (genkit, firebase-tools, wrangler) rapidly adopt local HTTP servers, OAuth callbacks, and Git workspace inspection, they introduce subtle cross-boundary vulnerabilities.
Using the Sibling Patch-Gap Engine, we uncovered a recurring class of vulnerabilities across flagship developer tools:
When an AI tool or CLI validates that a directory is a legitimate Git repository inside an allowed workspace, checking Path(repo).resolve() is not enough if the underlying Git library reads <common_dir>/objects/info/alternates or if linked Git worktrees (git worktree add) cause git_dir and common_dir boundary sets to diverge. Because Git follows objects/info/alternates transparently during object reads (git show, git diff), an attacker-controlled .git metadata directory inside an allowed workspace can point its object store to another repository outside the workspace without using a single filesystem symlink.
CWE-88) Surviving Command-Injection Fixes
When developers fix shell command injection (CWE-78) by replacing execSync("git ... " + userArg) with execFileSync("git", ["show", "-s", "--format=%B", userArg]), they eliminate shell metacharacter expansion. However, if userArg is not preceded by an end-of-options delimiter (--) or validated against a strict hex-SHA regex, passing --output=<path> as userArg turns git show or git diff into an arbitrary file-write primitive (CWE-88).
CWE-200)
When a CLI or SDK attaches Authorization: Bearer <token> or x-goog-api-key to an initial HTTPS request and relies on standard fetch(..., { redirect: "follow" }), standard runtime fetch implementations forward custom headers—or preserve POST bodies across 307/ 308 redirects—to cross-origin redirect targets unless headers are stripped on a redirect: "manual" hop check.
v1, v2, next)—for sibling functions that share the same architectural assumption.-- (End-of-Options) Everywhere in Subprocess ArraysexecSync with spawn stops shell injection (CWE-78), but it does /^[0-9a-fA-F]{7,64}$/..git Metadata Inside Untrusted Archives or Workspaces.git/ resolves within an allowed directory, plain-text Git configuration (core.fsmonitor, core.sshCommand, diff.external) and .git/objects/info/alternates can cross directory boundaries or execute commands when standard git subcommands run.
HM Shihabuddin Jashory (Shihab) (@jashory) is a security researcher, systems architect, and founder of Vision Flow, specializing in autonomous multi-agent verification systems, supply-chain security, and mission-critical software auditing.
Zenodo DOI)