Open source · MIT · v0.2.0
SHPBL Antibody Reactor
Security policies reproduce. OASB decides which offspring survive.
An evolutionary agent-security system composed from SHPBL capabilities. Candidate defenses are mutated and bred under external attack pressure; weak strains die, survivors reproduce. Every mutation, rejection, ancestor, and promoted vaccine remains inspectable.
220 / 270
Out-of-fold attacks detected
81.48%
Out-of-fold attack recall
5
Independent populations
4,454
Hash-chained evidence events
What it does
Defense breeding against external evaluation
This is a command-line program, not a metaphor. It reads a corpus of labelled agent artifacts, discovers candidate threat evidence from a training split, seeds a population of detection policies, and breeds them for twenty-four generations. Fitness comes from an externally supplied security evaluation, so the selection pressure is not written by the same hand that writes the defense. It has no runtime dependencies, makes no network calls, runs no model, and writes only to the output directory it is given.
The output is a vaccine: a portable policy artifact carrying its own genome, thresholds, staged deployment plan, and complete ancestry.
What makes it unusual
The security policy is the evolving artifact
Most detection work evolves a model and keeps the policy fixed. Here the policy itself is the organism: its rules are the genome, its threshold is a trait, its lineage is a record, and its death is preserved rather than deleted. A promoted defense can name its parents, the mutation that produced it, the rehearsal that admitted it, and every generation it survived.
One generation, nine steps
The lifecycle
Each generation runs the full cycle. Steps 1–7 repeat for twenty-four rounds; promotion and vaccination happen once, after the final survivor is chosen.
Step 01
Attack
An external corpus of authored attacks is applied to every living strain.
Step 02
Score
Fitness weighs detection, correlation quality, and benign restraint together.
Step 03
Survive / die
Elites carry forward. Everything below the line is killed, not quietly edited.
Step 04
Mutate
Rules are added, dropped, reweighted, and retargeted under a seeded policy.
Step 05
Rehearse
Every child is evaluated before admission. Compound regressions are refused.
Step 06
Breed
Two survivors cross. A self-cross records one parent, never a fabricated pair.
Step 07
Test
The next generation faces the same arena. No strain is trusted for its ancestry.
Step 08
Promote
One surviving descendant is selected once, then measured on a sealed holdout.
Step 09
Vaccine
The survivor is sealed into a portable policy artifact with its full genealogy.
Generations and family
Twenty-four generations of ancestry
24
Generations bred
40
Strains per generation
8
Elites carried forward
4,424
Mutation rehearsals recorded
The promoted champion is def-g24-c7fbd215ef: 41 rules, decision threshold 11.0459, generation 24. Its genealogy, its lineage graph, and the fossil record of the strains it outlived ship with the release as JSON and as a Graphviz .dot file.
Evidence
220 of 270 attacks, out of fold
Five independent evolutionary populations were run with the algorithm, hyperparameters, mutation policy, population size, selection criteria, and scoring locked before any fold started. Each of the 270 authored attack fixtures in the OASB v2 corpus was held out exactly once from the population that scored it. Detected out of fold: 220, or 81.48% attack recall.
Secondary evidence: a single sealed holdout, opened once after one champion had been selected, gave 29 of 34 attacks detected (85.29% recall). That denominator is small and is not comparable to a scanner measured over all 270 fixtures.
Every birth, rehearsal, generation, promotion, and seal is recorded in a 4,454-event SHA-256 hash chain anchored to the corpus hash and the run seed, so a valid chain from one run cannot be presented as evidence for another.
Out-of-fold results by attack family
Category results
Thirty authored attacks per family. The two weakest families are published at full weight rather than dropped.
- Data exfiltration29 / 30
- Persistence28 / 30
- Credential exfiltration27 / 30
- Heartbeat RCE27 / 30
- Prompt injection26 / 30
- Social engineering24 / 30
- Unicode steganography24 / 30
- Privilege escalation19 / 30
- Supply chain16 / 30
Fossil record
Rejected defenses are preserved, not erased
When a strain dies, its genome, its scores, and the reason it was killed are written to the fossil record. A rehearsal that refused a child is kept alongside the child it refused. The failures are the part that makes the survivor legible: you can see what was tried, what regressed, and what the population would not accept.
Genealogy
The final policy can identify its own parents
Each strain records its parents, its mutation operators, its generation, and its evaluation history. A self-cross records one parent rather than inventing a pair, and an elite carried forward reports the generation it actually reached. Walk the lineage from the champion back to a founding strain edge by edge.
Promotion
From surviving strain to deployable vaccine
Promotion is a single deliberate act, not a running average. One champion is selected from the final generation, and only then is the sealed holdout opened and measured. The surviving genome is sealed into a vaccine artifact carrying its rules and weights, its decision threshold, the measurement that justified it, its full ancestry, and a staged campaign plan that begins in shadow and canary before anything enforces on live traffic. A vaccine is a weighted-evidence text policy measured on one corpus. It can be evaded, and the release says so.
Reproducibility
Reproduce the experiment
Identical seed and identical corpus bytes produce byte-identical artifacts. Every timestamp that enters a published artifact comes from a logical clock, not wall time, so you can recompute the published evidence head yourself instead of taking it on trust.
git clone https://github.com/SweetKenneth/antibody-reactor && cd antibody-reactor
git clone https://github.com/opena2a-org/oasb /tmp/oasb
git -C /tmp/oasb checkout fddf2b1379c5597a3e83a3c6f7833b8e5613a04e
OASB_DIR=/tmp/oasb ./scripts/reproduce.shThat builds under strict TypeScript, runs 18 engineering checks, reproduces the sealed-holdout run, diffs a second identical run byte for byte, verifies the evidence chain, and reruns all five folds. The corpus is not redistributed; it is fetched from OASB.
- OASB commit · fddf2b1379c5597a3e83a3c6f7833b8e5613a04e
- Corpus SHA-256 · 3ca866a0e637fa198bae17cd3a8f31fb02ad20f50fedcac1caa290e6dceba14e
- Seed · 20260916 · Node 20 and 22
Methodology disclosure
What these numbers are not
OASB is selection pressure, not a held-out test set.
Training-split content drives rule discovery and validation labels decide which strains reproduce. The final champion’s in-sample performance is therefore not presented as an independent benchmark score anywhere on this page or in the release.
The defensible receipt is the out-of-fold number.
Five separate populations, each attack scored exactly once by a population that never evolved against it. That is what 220/270 means, and it is the only recall figure led with.
No false-positive-rate claim is made.
OASB withdrew its precision, F1, false-positive-rate, and flag-rate metrics because much of its benign class was labelled using the scanner under test. Benign disagreement here (49 of 3,975 out of fold) is used as counter-pressure against flag-everything behaviour and reported as disagreement with corpus labels, nothing more.
No comparability, and no endorsement.
No comparison to OASB or HackMyAgent historical scores is claimed. Depending on and citing OASB is not certification, approval, or endorsement by the OASB project or its maintainers.
No sample identifier, expected answer, fixture filename, or result category is hard-coded. Classification depends only on artifact content and the evolved genome, and a test asserts that changing every sample identifier cannot change a verdict.
Provenance
Composed from SHPBL capability, distributed without it
The reactor was composed from capability bodies in the private SHPBL/CMPSBL library: the antibody generator and defense breeder, the mutation rehearsal engine, the evidence ledger, the vaccine synthesiser, and the campaign planner. The release identifies those parents by unit name and seal in PROVENANCE.json so the composition is traceable. The library itself is not distributed — not in whole, not in part. The OASB corpus is likewise not redistributed.
The public release is MIT so it can be adopted, forked, and audited without permission. That grant covers this repository only.
Download
Get the release
- Version
- v0.2.0 · MIT
- Released
- 2026-09-16
- Size
- 1,608,728 bytes (1.53 MB)
- Commit
- 6897ac06e9eed99eb6e9066176710b52e8becb47
- SHA-256
- ed51a9c8eedfaa9cc795f5e776d7ad02e3d430bf201af413d3354f570b700e43
Both downloads are the same bytes. Verify with shasum -a 256 antibody-reactor-v0.2.0.zip and compare against the hash above.
External validation status
Submitted for independent review
The release, its methodology, and its limitations were submitted to the OASB project through the adopter and independent-evaluation issue path documented in its contributing guide, with full disclosure that OASB was used as evolutionary selection pressure. No hosted scanner submission was made: a system that evolved against this corpus should not be entered as though the corpus were unseen, and the hosted submission endpoint is not currently reachable. Submission is a request for scrutiny. It is not endorsement, and nothing here claims OASB has given any.
- Submission type · OASB adopter / independent-evaluation issue
- Entry · opena2a-org/oasb issue #39 · 2026-09-16
- Release · v0.2.0 · commit 6897ac06e9eed99eb6e9066176710b52e8becb47
- Hosted scanner submission · none