How My 8-Layer Autonomous Agentic Security Architecture Found Validated Vulnerabilities in NASA Flight Software and Google Cloud Ecosystems Security researcher HM Shihabuddin Jashory (Shihab) built an 8-layer autonomous agentic security architecture that pairs a 4-tier multi-agent verification hierarchy with a sibling patch-gap engine, and used it to surface validated vulnerabilities in NASA flight software and Google Cloud ecosystems. The work produced a merged fix in nasa/fprime (PR #6299) and two P2-triaged disclosures in the Google Vulnerability Reward Program, among 10 active Google VRP disclosures, with additional audits across NASA, the Space Telescope Science Institute, Google, Bazel, ChromeDevTools, Anthropic and Cloudflare repositories. The architecture enforces that every finding be backed by a benign proof-of-concept and a git diff remediation patch, with adversarial review at the Chief Auditor tier to disprove exploitability. Author : HM Shihabuddin Jashory Shihab GitHub : @jashory https://github.com/jashory | ORCID / Research DOI : 10.5281/zenodo.23832719 Canonical Gist : 8-Layer-Agentic-Architecture-NASA-Google-Case-Study.md Most automated security scanners drown maintainers in theoretical alerts and false positives. Over the past year, I designed and deployed an 8-Layer Autonomous Agentic Security Architecture DOI: 10.5281/zenodo.23832719 https://doi.org/10.5281/zenodo.23832719 built around a simple premise: every security patch is a map to the bugs that were missed right next to it. By combining a 4-Tier Multi-Agent Verification Hierarchy with a specialized Sibling Patch-Gap Engine , this architecture systematically audited mission-critical open-source infrastructure—resulting in: nasa/fprime spacecraft flight software framework PR 6299 @bitWarrior from GHSA-pq8v-c63j-wv29 P2 triaged disclosures in Google Vulnerability Reward Program Google VRP Issue 580130935 and Issue 580032520 , among 10 active Google VRP disclosures . GHSA / VDP nasa/fprime-gds , nasa/CryptoLib , nasa/spacewasm , nasa/openmct , nasa/earthdata-search , nasa/harmony , the Space Telescope Science Institute spacetelescope/jwql for the James Webb Space Telescope , Google google/adk- , google-gemini/gemini-cli , googleapis/mcp-toolbox , cdapio/cdap , genkit-ai/genkit , firebase/firebase-tools , google/osv-scalibr , angular/angular-cli , google/oss-fuzz , Bazel bazelbuild/bazel-central-registry , ChromeDevTools ChromeDevTools/chrome-devtools-mcp , Anthropic modelcontextprotocol/inspector , modelcontextprotocol/servers , and Cloudflare cloudflare/workers-sdk . Here is an inside look at the architecture, why Sibling Patch-Gap Analysis works so reliably on hardened codebases, and how multi-agent verification eliminates the "AI slop" crisis in security research. Traditional SAST tools rely on fixed syntactic rules. When they scan a million-line C++ flight software repository or a distributed TypeScript cloud SDK, they flag thousands of low-impact patterns while completely missing domain-specific trust boundary violations. Conversely, first-generation LLM bug-hunting scripts hallucinate attack paths that cannot actually execute because they never compile the target, never inspect runtime state, and never verify whether an upstream reverse proxy or caller already sanitizes the input. When I architected the 8-Layer Autonomous Agentic Security Architecture DOI: 10.5281/zenodo.23832719 , I enforced two strict engineering invariants: git diff remediation patch. Worker - Supervisor - Chief Auditor - Tier-0 System Integrator +-------------------------------------------------------------------------+ | Tier-0: System Integrator SI | | Final cross-check of source code, benign PoC output, and git diff patch | +-------------------------------------------------------------------------+ ^ | +-------------------------------------------------------------------------+ | Tier-1: Chief Auditor | | Adversarial review: attempts to disprove exploitability & check guards | +-------------------------------------------------------------------------+ ^ | +-------------------------------------------------------------------------+ | Tier-2: Supervisor Agent | | Orchestrates target scope, CWE taxonomy, and sibling commit graph audit | +-------------------------------------------------------------------------+ ^ | +-------------------------------------------------------------------------+ | Tier-3: Specialized Worker Agents | | Shallow clone, AST/dataflow trace, benign local harness & patch builder | +-------------------------------------------------------------------------+ When a security team patches a vulnerability CVE or GHSA , human engineers naturally focus on the exact file, function, or branch reported in the advisory. However, large engineering repositories rarely implement a pattern only once: filepath.Rel or Path.resolve in one handler, a sibling handler—or a v2 rewrite branch—often misses the edge case such as trailing separator absence, Windows volume-relative paths, or Git worktree alternates . Instead of scanning codebases blindly from scratch, the engine executes a 4-stage loop: CVE and hardening commits fix security : , Harden ... , Validate ... , Escape ... across target repositories. target.startswith base dir Path target .resolve .is relative to Path base dir .resolve execFileSync , os.Open , git.Repo , fetch redirect handlers . F´ F Prime https://github.com/nasa/fprime is NASA Jet Propulsion Laboratory's JPL flight-proven software framework used for spacecraft, CubeSats, and instruments including the Mars Helicopter Ingenuity heritage ecosystem . In earlier security hardening PR 5320 and PR 5850 , NASA introduced Os::SandboxedFile to enforce strict directory containment for flight file operations across components such as Svc/FileUplink , Svc/FileDownlink , and Svc/FileManager . CWE-22 — Missing Os::SandboxedFile in Svc/CmdSequencer Using the Sibling Patch-Gap Engine , our architecture mapped every component in nasa/fprime that opens flight files by path and compared their Os::File declarations against the Os::SandboxedFile migration: FileUplink , FileDownlink , and FileManager had been migrated to Svc/CmdSequencer/FPrimeSequence.hpp:237 and Svc/CmdSequencer/FPrimeSequence.cpp:373-449 still instantiated a raw, unsandboxed Os::File m sequenceFile; . CmdSequencerImpl::validate / CS VALIDATE / CS RUN bypassed the We reported the root cause along with a clean, flight-code-compliant remediation patch via GitHub Private Vulnerability Reporting GHSA-pq8v-c63j-wv29 https://github.com/nasa/fprime/security/advisories/GHSA-pq8v-c63j-wv29 . CmdSequencer had been missed during the Update CmdSequencer's FPrimeSequence to use Os::SandboxedFile Following that validation, our engine expanded across NASA's broader flight and ground-data software portfolio, submitting verified defensive reports with ready-to-merge patches for: GHSA-rm58-f49w-5c3g GHSA-pfm4-7hrj-24jp GHSA-3p2g-79q9-39cr GHSA-mhv6-5g6q-c4jg Issue 2111 Issue 995 Issue 1809 As AI agent protocols MCP / Model Context Protocol and cloud CLIs genkit , firebase-tools , wrangler rapidly adopt local HTTP servers, OAuth callbacks, and Git workspace inspection, they introduce subtle cross-boundary vulnerabilities. Using the Sibling Patch-Gap Engine , we uncovered a recurring class of vulnerabilities across flagship developer tools: When an AI tool or CLI validates that a directory is a legitimate Git repository inside an allowed workspace, checking Path repo .resolve is not enough if the underlying Git library reads