A vulnerability research harness for agentic and human interactions
Framepath captures how vulnerability research actually happens: a human pokes at a target, an agent proposes a hypothesis, a tool emits a trace, a crash becomes a question, and the team needs to know exactly how they got there.
It is a harness for preserving the path, not just the result. Framepath records prompts, commands, tool output, environment state, artifacts, analyst notes, and agent decisions so findings can be replayed, reviewed, and trusted.
Use Framepath to turn adversarial exploration into durable evidence. Every branch of investigation can become a reproducible record: what was tried, what changed, what failed, what worked, and why the finding matters.
Built for vulnerability research teams that mix humans, agents, debuggers, fuzzers, static analysis, custom scripts, and weird one-off intuition. Framepath keeps the whole mess coherent without sanding off the important details.
Capture the workflow
Framepath is engineered around the messy loop of vulnerability research: hypothesis, experiment, observation, pivot, reproduction. It captures the interaction between humans, agents, tools, and targets as a first-class artifact.
- Record agent plans, human edits, terminal commands, browser sessions, scripts, traces, payloads, and notes in one timeline
- Preserve enough context to understand why a path was taken, not just which command happened to run
- Attach artifacts directly to the decision that produced them: requests, responses, cores, logs, diffs, screenshots, and proof material
- Keep abandoned branches visible so future researchers can see what was ruled out and avoid rediscovering dead ends
Reproduce findings
A finding is not real until someone else can make it happen again. Framepath turns successful paths into replayable records that survive handoff, review, disclosure, and regression testing.
- Pin target state, inputs, configuration, environment facts, and tool versions alongside the evidence
- Generate reproduction steps from the captured workflow instead of asking researchers to reconstruct them from memory
- Separate observation, interpretation, and proof so reviewers can inspect the chain without trusting a black box
- Track fixes against the original path to prove the vulnerability is gone, not merely hidden behind changed behavior
Human and agent collaboration
Framepath treats agents as research partners whose actions need the same provenance as human actions. The point is not to replace the analyst; it is to make mixed human-agent work inspectable.
- Hand off hypotheses between humans and agents with the supporting context attached
- Constrain agents to scoped targets, approved tools, and explicit evidence requirements
- Compare competing paths when multiple agents or analysts investigate the same surface
- Promote promising exploration into structured findings without losing the raw trail
Evidence model
Framepath stores the research path as evidence: ordered events, attached artifacts, claims, and reproduction anchors. It is designed for review, disclosure, and long-term institutional memory.
- Timeline of who or what acted, what changed, and what evidence was produced
- Claims linked to supporting observations instead of buried in prose
- Reproduction anchors for setup, trigger, expected impact, and fix verification
- Reviewable provenance for human judgment, agent actions, tool output, and final conclusions
Framepath is for making research durable: captured while it happens, reproducible after the fact, and understandable by people who were not in the room.
Operational boundaries
Framepath is built for sensitive adversarial work where artifacts may include customer data, exploit material, private source, or embargoed vulnerability details. The harness keeps provenance and access control attached to the research record.
- Scoped workspaces for targets, artifacts, agents, and reviewers
- Evidence trails that distinguish raw observation from analyst conclusion
- Exportable records for disclosure, customer handoff, internal review, and regression tests
- Policy controls for what agents can inspect, execute, exfiltrate, or promote into findings
About
Framepath exists because vulnerability research is not a neat pipeline. It is adversarial, iterative, collaborative, and full of context. The valuable part is often the path through the uncertainty.
Our goal is to make that path durable enough to audit, replay, teach, disclose, and defend. Humans bring judgment. Agents bring tireless exploration. Framepath gives both a shared record.
For further information or to request a demonstration, contact: [email protected]
–––