Run long AI pentests and code audits that end in reproducible reports
Vigil is an AI harness for long-running code audits, web pentests and bug bounty hunting, built around how investigations fail: anchored hypotheses, false negatives and unreproducible reports.
Source
VigilOSS on Hacker News · 2026-10-10 · Project link
Written in our own words. Credit to the original author. Link checked 2026-10-23.
What they did
Vigil is an AI harness for long-running code audits, web pentests and bug bounty hunting, built around how investigations fail: anchored hypotheses, false negatives and unreproducible reports.
Result (as claimed)
Findings come with steps someone else can reproduce.
Tools they used
Cost: Pricing depends on the tools you pick; check each official pricing page.
Set it up
Pick a contained repo or task
Start on a branch or side project where mistakes are cheap.
Install and configure
Set up Vigil. Read what it can run on your machine and limit permissions where possible.
Run it on a real task
Give it a well-scoped issue and let it work. Review the diff like any pull request.
Add guardrails
Keep tests and CI in the loop, and never let an agent push to main or touch production secrets unattended.
Copy the full setup prompt
Paste into your agent and it will walk you through the setup, asking before anything that sends, posts or spends.
You are helping me set up this AI use case end to end in Claude Code. Goal: Run long AI pentests and code audits that end in reproducible reports What the original author did: Vigil is an AI harness for long-running code audits, web pentests and bug bounty hunting, built around how investigations fail: anchored hypotheses, false negatives and unreproducible reports. Reported result (as claimed by the author): Findings come with steps someone else can reproduce. Source: https://news.ycombinator.com/item?id=50034204 Tools they used: Vigil Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Codex. Goal: Run long AI pentests and code audits that end in reproducible reports What the original author did: Vigil is an AI harness for long-running code audits, web pentests and bug bounty hunting, built around how investigations fail: anchored hypotheses, false negatives and unreproducible reports. Reported result (as claimed by the author): Findings come with steps someone else can reproduce. Source: https://news.ycombinator.com/item?id=50034204 Tools they used: Vigil Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
You are helping me set up this AI use case end to end in Grok Bot. Goal: Run long AI pentests and code audits that end in reproducible reports What the original author did: Vigil is an AI harness for long-running code audits, web pentests and bug bounty hunting, built around how investigations fail: anchored hypotheses, false negatives and unreproducible reports. Reported result (as claimed by the author): Findings come with steps someone else can reproduce. Source: https://news.ycombinator.com/item?id=50034204 Tools they used: Vigil Category: Dev & ops Please: 1. Ask me 3 short questions about my situation (accounts I have, budget, what I want the output to look like). 2. Propose a step-by-step plan using these tools or cheaper alternatives, with the time and cost of each step. Use official pricing pages; say "check pricing" if unsure. 3. Then do the setup with me one step at a time, waiting for my OK before anything that sends messages, posts publicly, spends money or deletes data. 4. Finish with a checklist to run it again next time.
The Daily 5
Get five new use cases tomorrow morning
Free. Real sources. Unsubscribe any time.
Guides for this use case
How to use AI agents for security scans and threat intel · How to secure vibe-coded apps and agents
Related use cases
Run Claude Code and VS Code on an iPad with a Linux layer
LinPad OS brings Linux to the iPad with git, Python, Node.js, VS Code and a terminal, and Claude Code is listed in its store.
Checkpoint long Claude Code runs and resume after the usage reset
Steward saves checkpoints of long Claude Code runs so you can resume after your usage window resets. A portable preview also supports Codex and local models, and switching provider starts a fresh chat from the checkpoint.
Write end-to-end tests in plain English with an open-source agent framework
e2e is an open-source testing framework that combines AI agents with normal end-to-end tests: you describe what the user should do in plain English instead of manually scripting every click.
Run end-to-end tests on Windows desktop apps in parallel with recordings
QA Wolf can now run end-to-end tests for Windows desktop apps, 100% parallel, live streamed and recorded, using the same APIs it uses for web and mobile tests.