AETHER AI · PREDATOR
AI security research, software repair, and authorized VM workflows.
Predator brings AI reasoning, persistent context, and reviewed tool use into security research and software repair. Its research engine, Crucible, works like a lockpick: it holds verified evidence steady, proposes candidate chains, checks them against the real software, and banks only supported results. A QUBO can rank the next test; the recorded solver and native result determine what actually ran and what was established. Quantum simulation or hardware is identified only for runs that used it.
This is the public feature showcase and evidence collection. The CLI and operator engines are private, with reviewed research access.
P-BOX / HTB training · Gen3 Private Security · Crucible · MITRE chains · CVE catalog · CodePro & System-2 · joint5 & IBM Fez · Results · Work with Aether · Docs
Give Predator a goal, confirm the VM, and follow along as it works.
P-BOX is Predator's disposable Linux pwnbox for authorized CTF and HTB missions. Predator can spawn the VM when a hosted Pwnbox is unavailable, giving it a place to work that you can watch and control.
| What you can do | How it works |
|---|---|
| Confirm and start | You confirm the VM before Predator begins work within the approved mission. |
| Work toward longer goals | Predator works autonomously through reviewed terminal actions, reads fresh guest output, and chooses the next step within the approved mission. |
| Watch, take over, and resume | Watch the guest live, take control yourself, hand it back to Predator, or stop the mission. |
| Clean up automatically | The VM's disk is removed when you stop it or its lease expires. |
The recording below includes challenge spoilers and visible lab command history.
P-BOX in action · Predator / GLM-5.3 · 670 recorded guest frames · Ghostlink evidence and execution roles
About this GLM-5.3 replay
The featured GIF comes from Predator's GLM-5.3 Ghostlink mission in P-BOX. It contains 670 recorded guest frames at 1600 × 920, with blank browser-loading frames removed. The frame provenance records the retained source-frame hashes and GIF hash.
The machine guide records GLM-5.3's research and the operator's later actions. The screen recorder stopped before the final user and root challenge-file reads; those observations are documented separately.
HTB is a test and training ground for Predator's agent and VM workflows. These two examples show autonomous VM command work and saved lab research, with completion records and execution roles in their guides.
The Satellite replay includes challenge spoilers. Both GIFs are assembled evidence replays.
| Nmap course · autonomous VM work | Satellite Exploitation · recorded lab work |
|---|---|
 |
 |
| 12/12 Academy sections completed. Predator through GLM-5.3 ran the VM commands autonomously. The owner supplied prompts and exercise questions, then entered the answers. Course record and replays → |
9/9 labs completed. The certificate and account activity support completion; the replay covers four saved lab records. Certificate, lab list, and replays → |
More HTB records and replay notes
| Module or track | Recorded progress | Open the guide |
|---|---|---|
| Academy: Network Enumeration with Nmap | 12/12 sections completed · October 3, 2026 | Completion record and two replays |
| Satellite Exploitation | 9/9 labs completed · October 5, 2026 | Certificate, lab list, and replays |
| AI and ML Exploitation | 1/17 labs HTB-accepted · in progress | Lab status and three replays |
| Machine: BlockSynergy | User and root challenge files read · October 5, 2026; owner confirmed | Machine record and sanitized replay |
| Machine: Ghostlink | User and root challenge files read · October 5, 2026; HTB submission unobserved | Machine record and full-screen pwnbox replay |
The earlier Pwnbox console preview shows a separate reviewed guest-session check. AI/ML counts only HTB-accepted results toward completion. The machine guides distinguish Predator research from operator execution and explain what their recordings contain.
Browse all HTB modules, certificates, and replays →
Gen3 is the name for Predator's current research workflow and the evidence it leaves behind. It describes a method, not a measured quantum advantage.
Four scoped case studies from October 2026, each with its validation and disclosure status kept separate. Each one was run through the Crucible loop described in the next section:
| Target | Public evidence | Status |
|---|---|---|
| Vercel AI SDK | Redacted local P-BOX replay | Verified local result with synthetic values; no production access. |
| Gemini CLI | Sanitized Crucible sprint graphic | Three private Google Cloud VRP reports under triage; no assigned severity or reward. |
| GitLab Duo | Private-research tactic map | Owner-controlled local validation; no vulnerability report filed. |
| Anthropic SDK | Conditional AX research map | Three owner-controlled local paths from one shared boundary; no vulnerability report filed. |
Predator's VPS3 P-BOX also supported a local security test of the Vercel AI SDK. The public replay shows the disposable Linux desktop and a verified local result. It uses synthetic values; no Vercel production account or service was accessed.
Five actual guest captures · seven replay frames · selective FFmpeg blur · provenance and disclosure limits
On October 9, 2026, Predator's manual research workflow ran a deep Gemini CLI Crucible sprint across the C1 → Q173 checkpoint span. Three separate reports were filed privately with Google Cloud VRP during the day. They remain under triage; no severity or reward has been assigned.
Public taxonomy only: Defense Evasion → Execution → Credential Access → Exfiltration. No reproduction details or credential material.
The two views show one caller-calibrated model checkpoint, with private attack-condition labels removed. Its weights are research bookkeeping; they do not independently verify a finding, measure exploit probability, establish quantum advantage, or set a Google bounty tier. Validation evidence remains in the private reports while triage is pending.
Predator began an owner-controlled GitLab Duo research sprint on October 9, 2026. The graphic below is a C1 → Q48 snapshot from October 10; later manual checkpoints remain private. These labels identify research checkpoints, not executed quantum interventions or a paid CFC run. The local result maps at the MITRE ATT&CK tactic level to Execution → Credential Access → Exfiltration. This is a research map of an owned test, not a claim about an attack on another user.
Private findings: technical details have not been disclosed and no vulnerability report has been filed. No severity or bounty has been assigned. The saved evidence does not establish zero-click execution or a sandbox escape.
October 10 snapshot · owner-controlled validation · tactic names only · no reproduction steps, secrets, or third-party data
On October 10, 2026, Predator banked AX001–AX003 as three conditional outcomes of one shared trust boundary in owner-controlled local fixtures. Their public MITRE ATT&CK tactic lenses are Collection, Credential Access, and Execution. These are parallel research paths, not one completed attack sequence or three independently confirmed vulnerabilities.
The saved evidence does not establish a deployed lower-trust writer route, Claude-selected tool action, real credential exposure, or deployed code execution. No vulnerability report has been filed, and no severity or bounty has been assigned. Technical reproduction details remain private.
Owner-controlled fixtures · parallel tactic lenses · no reproduction steps, secrets, or third-party data
Think of a lockpick. Hold tension, test one pin at a time, and keep every pin that sets.
Crucible is Predator's software research and repair loop. It starts with a pinned source revision, a defined question, and fixed acceptance checks. The easiest way to picture it is a lock being picked: one hand holds tension so nothing already gained can slip, the other tests pins until one clicks, and a pin that sets stays set while the next one is worked.
One depth step of the loop, drawn as a lockpick. Visual by Mythos 5.1.
The four pins illustrate a research design, not four measured workers or native checks in every run. The execution and evidence guide separates the CFC selector, an admitted exploit ratchet, and manual research. It also defines the minimum candidate record and the native effect needed for a zero-click claim. A model score, a worker proposal, and a native result are different records.
| In the lock | In Crucible | What it does |
|---|---|---|
| Tension wrench | Master checkpoint (C) | Holds verified evidence with its provenance, signatures where present, the passes that must not be lost, and obligations still open. A manual checkpoint is not signed merely because it has a C label. |
| Pins | Candidate chains | Fanout proposes alternatives from a checkpoint. A proposal and its QUBO ranking do not imply that a native check ran. |
| The click | Native check | The software itself says whether a pin set. A chain with no native receipt did not click, whatever the model thought of it. |
| A set pin | HIT | Banked only with an appropriate native receipt. Misses, refutations, and inconclusive results stay in the record with their limits. |
| Choosing the next pin | QUBO selection and evidence gate | A modeled energy can rank a test; native outcomes determine what is supported. JEV participates only when an admitted stage records a typed call and its usage. Its decision is advisory, not an independent software result. |
| Working the set pin | Repair lane | Pair a supported attack observation with a repair hypothesis and regression plan. A fix counts as validated only after its own check. |
| Step | What happens |
|---|---|
| Pin | Freeze the source revision, scope, evidence, and acceptance checks. This is the tension. |
| Fan out | Open several small candidate chains from the checkpoint. Each proposes a threat path or repair. |
| Model | State the target facts, candidate choices, constraints, and provenance. A bounded QUBO can rank tests; not every library chain has a populated energy profile. |
| Search | Record the solver actually used. A classical minimum is one valid selection method; a simulator or quantum device is a separate, explicitly evidenced run. |
| Validate | Run the admitted native check and retain its receipt. A proposal without that check remains a hypothesis. Record HIT, miss, refutation, or inconclusive outcome accurately. |
| Select and carry | Carry the supported evidence and open obligations into the next checkpoint. Pair an attack observation with a repair record; verify the repair separately. |
Each cycle leaves a checkpoint, and each checkpoint seeds the next intervention. A failed check is not wasted: it can reveal a missing constraint or a repair obligation that shapes the next pin.
C0 → Q1 → C1 → Q2 → C2 → Q3 → C3
| Label | Meaning |
|---|---|
| C | A saved evidence checkpoint. The tension at that depth. |
| Q | A dependent quantum-method intervention when one actually ran. Manual C/Q shorthand can label research stages, but the label alone is not an execution receipt. |
| Quantum depth | How many evidenced, dependent quantum-method interventions ran in one chain. Circuit depth is a different number: the size of the circuit inside one intervention. |
The ratchet is the rule that verified earlier results and negative evidence remain visible while the next candidate is checked. It does not guarantee that a later candidate will pass. In the CharLS case, Q3 used C2's remaining repair obligation to move from 16/24 to 24/24 protected test passes, retaining all 16 earlier passes.
Methods, evidence, and current limits
QUBO stands for quadratic unconstrained binary optimization. Its energy is the modeled cost to minimize; a low energy is a reason to test a candidate, not proof that it works. Only the native check on the software sets a pin.
The public CharLS and QPACK studies used quantum-circuit simulation. The joint5 pilot supplies a separate hardware record. Jev can provide structured triage only after the stage path is enabled, qualified, and deployed. A NOT_CONFIGURED field, an adapter in source, or an offline preflight is not a provider call. A participating run must record its typed decision, call count, and spend; JEV never terminates a chain on its own.
Where issued, signed custody binds research stages to source and artifacts. Manual research notes and C/Q labels are not signed receipts. Live signed acceptance, server-side stage minting, and variable-depth custody remain under validation. Each continuation needs its own scope, budget, and admission.
Gen3 seeks attributable quantum advantage over credible AI-only and classical alternatives, with matched resources and independent replication. Quantum advantage and a measured Jev contribution remain unestablished. The lockpick figure illustrates the loop's control structure; it is not a measurement, a severity, or a claim of advantage.
424 source-bank chains · 18 routing buckets · October 10, 2026 V16 registry snapshot
A pin is only as good as its source and test. The library provides chain definitions, prerequisites, and references for candidate generation; a new source-grounded hypothesis can also be proposed. The 424 count is catalog coverage, not 424 tested exploits or 424 calibrated energy models. Most profile slots are explicitly unmodeled. The map shows the 15 current MITRE ATT&CK Enterprise tactics alongside Aether's AI injection, MCP, and memory-safety research areas. Predator's routing labels are maintained separately from MITRE's tactic names.
Open the full-size research map · GX, GLX, and AX are public case-family labels; no exploit steps are shown.
| What a chain contains | Why it helps |
|---|---|
| Connected steps | Show how a proposed path depends on earlier conditions. |
| Prerequisites and references | Keep the model tied to stated assumptions and cited sources. |
| Routing category | Organize the review around the relevant research surface. |
Research mode follows chain and CVE references to develop cited hypotheses, counterexamples, and proposed extensions; it is the c-stage of a pin. Source review and appropriate checks on the software must establish observed behavior before a modeled path becomes a finding.
AX001, AX002, and AX003 mark conditional local research paths with Collection, Credential Access, and Execution tactic lenses. The paths share one underlying trust boundary and are shown separately in the Anthropic research card. The public map does not claim a sequential exploit, a deployed integration, or a vendor-confirmed finding.
The vulnerability records the chains anchor to.
Alongside the chain library, Predator maintains a catalog of CVE records, affected products, advisories, problem types, and scoring data. CVE IDs connect those records to chain anchors so an investigation can follow the underlying evidence.
| Part of the catalog | What it contributes |
|---|---|
| CVE source records | CVE JSON 5.x imports and affected-product information. |
| Separate enrichment | NVD, CISA KEV, and FIRST EPSS data alongside the source records. |
| Research review | Deep-cycle integration reads shortlisted full CVE cards before ranking and records what was reviewed. |
Drive uses the approved mission's pinned evidence for investigation and validation. Catalog coverage and freshness depend on completed imports and pinned snapshots.
Many workers, one evidence trail. When Crucible fans out, it needs a way to give several workers the right context at once and to read their answers back as one record. That is CodePro.
| Part | What it does, in plain terms |
|---|---|
| CodePro fanout | In an admitted run, starts scoped workers and records each returned claim and provider receipt. A manual research turn or unavailable dispatch path is not a completed fanout. |
| System-2 shared IR | Aligns claims, evidence references, and open questions from workers that use the same intermediate representation. |
| Clean model worktrees | Source-backed runs can isolate model work in pinned Git worktrees. The run record identifies the actual checkout and revision rather than assuming isolation. |
| Unlimited Context (UCL) | Keeps source-backed evidence in named memory pools across sessions and models. “Unlimited” describes retrieval reach: relevant slices enter the model’s normal attention window. |
CodePro implementation links
System-2 orchestration · Native compiler · Benchmarks
Implementation links require repository access.
The private Predator CLI brings research, tools, and persistent evidence into one conversation. Choose an available Aether model, keep each run attached to its sources and approved scope, and continue from saved work. Restart checks verify the task, worktree, and memory-pool identity.
| Capability | What it does |
|---|---|
| Research and Drive | Cross-reference chains and CVEs, review candidates, and run approved investigation and validation stages. |
| Predator RC | Follow browser and CLI activity through an encrypted relay, take over, and hand control back. |
| P-BOX | Spawn a disposable Linux pwnbox for a confirmed mission, with live viewing, operator control, and automatic cleanup. |
| Guest consoles | Work through supported Pwnbox/noVNC sessions or an owned VM in an authorized training lab. |
Browser, RC, and guest-session status
Supported Pwnbox/noVNC sessions have recorded attachment, observation, reviewed input, human takeover, resume, and cleanup. An owned Ubuntu VM supplied the Academy workflow shown earlier. Other CTF, Sherlock, VM, and VPN environments need their own scope and validation.
RC is in controlled private preview. The production viewer and relay have been exercised in an owner validation; the complete sign-in, mission selection, and controller hand-back journey remains under validation. Browser and guest sessions require a fresh check after interruption.
What the compiler does. In an AQRC run, a QUBO represents yes/no choices with a cost to minimize. Before a quantum simulator or a real device can sample it, AQRC compiles that problem into a circuit. joint5 is AQRC's alternative compilation path. A better compilation uses fewer native gates and gives output closer to the ideal distribution; it does not by itself find a better answer.
What was measured. The joint5 pilot compared ordinary and joint5 compilation on IBM Fez: one six-variable fixture, its vulnerable and fixed poles, four circuits, and 1,024 shots per circuit in one hardware job (3 seconds of billed QPU time).
| Measurement | Ordinary → joint5 | Change |
|---|---|---|
| Native two-qubit gates, each pole | 144 → 103 | 28.5% fewer |
| Distance from ideal output, vulnerable pole | 0.3952 → 0.3165 | 19.9% lower |
| Distance from ideal output, fixed pole | 0.4039 → 0.3080 | 23.7% lower |
Lower total-variation distance means closer agreement with the ideal output distribution. Expected energy worsened on both poles. The pilot records one acquisition without independent confirmation. Improved minimization and quantum advantage remain unestablished.
Measurements and uncertainty → · Full-precision data →
Two open-source test cases, published with their data and their limits. CharLS and QPACK carry deliberately introduced faults, so the loop can be scored against a known answer. “Banked” means the result and its evidence are retained and can be checked.
| CharLS Q3 repair | QPACK feedback study |
|---|---|
 |
 |
| Study | Recorded result | What it shows |
|---|---|---|
| CharLS Q3 repair | 16/24 → 24/24 protected passes; eight gained, all earlier passes retained | The ratchet working as described above: a dependent repair at depth 3 closed the obligation left by depth 2, on real C++ source, without dropping a single earlier pass. |
| QPACK feedback study | 5/8 controlled faults found with feedback, versus 2/8 without it | A second pass at the pins, informed by the first pass's native checks, found more than one pass alone in this exploratory campaign. The adaptive classical comparison was incomplete, so the quantum selector's own contribution was not isolated. |
Both studies used deliberately introduced faults. A newly discovered CVE finding has not been published. Discovery, matched comparisons, and quantum advantage remain active research objectives.
Commission a focused repository mission, qualify a repeatable security profile, or scope an authorized live assessment.
 |
 |
| Path | Best fit | Start here |
|---|---|---|
| Predator Strikes | A known CVE fix, focused discovery, or chain analysis for one agreed repository surface | Discuss a Strike → |
| Predator CI | Repeatable checks against a qualified repository profile and exact commit; private preview | Qualify a profile → |
| Predator Red Team | An authorized assessment of a live environment, with reviewed findings and remediation | Scope an assessment → |
Agree on the surface, acceptance checks, and handoff before work begins. Live assessments also require approved targets, methods, timing, contacts, and stop conditions. The linked service pages list current pricing and terms; broader engineering work starts with a project inquiry.
Read the safety model → Human-approved scope and budgets bound each run. Memory, model suggestions, and quantum results supply evidence; authority comes from the approved mission. The guide distinguishes required policy from controls proven in code.
Ask about the published studies, suggest a public demo, or share feedback in GitHub Discussions. Use issues for concrete documentation corrections.
Contributing guide · Community guidelines · Security reporting
Help build the CLI, repair chains, verification tools, or classical/quantum comparisons. Tell us what you have built and where you want to contribute. Private research access is reviewed separately.
Predator CLI console preview · illustrative layout and counters
| Start with | Then explore |
|---|---|
| P-BOX feature showcase | VM lifecycle, operator control, and recorded guest session |
| HTB training evidence | Courses, tracks, machines, certificates, and replay index |
| Crucible | The loop explained as a lockpick, with MITRE chains and the CVE catalog it draws on |
| CodePro and System-2 | How the fanout runs, and the private CLI around it |
| CharLS Q3 | Public data and the completed dependent repair |
| QPACK study | Episode data, comparisons, and missing outcomes |
| joint5 IBM Fez pilot | Public data, uncertainty, and the energy regression |
| Research roadmap | Generation goals and the requirements for promoting research into qualified profiles |
| Predator safety model | Required boundaries and the status of implemented controls |
| Unlimited Context | How it works and safety measures |
Public overview and selected research notes · Private operator engines
© 2026 Aether AI LLC. All rights reserved. IBM is identified as a hardware provider; no affiliation or endorsement is implied. Visual sources.