Skip to content

Open source · MIT · v0.2.0

SHPBL Antibody Reactor

Security policies reproduce. OASB decides which offspring survive.

An evolutionary agent-security system composed from SHPBL capabilities. Candidate defenses are mutated and bred under external attack pressure; weak strains die, survivors reproduce. Every mutation, rejection, ancestor, and promoted vaccine remains inspectable.

220 / 270

Out-of-fold attacks detected

81.48%

Out-of-fold attack recall

5

Independent populations

4,454

Hash-chained evidence events

What it does

Defense breeding against external evaluation

This is a command-line program, not a metaphor. It reads a corpus of labelled agent artifacts, discovers candidate threat evidence from a training split, seeds a population of detection policies, and breeds them for twenty-four generations. Fitness comes from an externally supplied security evaluation, so the selection pressure is not written by the same hand that writes the defense. It has no runtime dependencies, makes no network calls, runs no model, and writes only to the output directory it is given.

The output is a vaccine: a portable policy artifact carrying its own genome, thresholds, staged deployment plan, and complete ancestry.

What makes it unusual

The security policy is the evolving artifact

Most detection work evolves a model and keeps the policy fixed. Here the policy itself is the organism: its rules are the genome, its threshold is a trait, its lineage is a record, and its death is preserved rather than deleted. A promoted defense can name its parents, the mutation that produced it, the rehearsal that admitted it, and every generation it survived.

One generation, nine steps

The lifecycle

Each generation runs the full cycle. Steps 1–7 repeat for twenty-four rounds; promotion and vaccination happen once, after the final survivor is chosen.

01Attack
02Score
03Survive / die
04Mutate
05Rehearse
06Breed
07Test
next gen
08Promote
09Vaccine
  1. Step 01

    Attack

    An external corpus of authored attacks is applied to every living strain.

  2. Step 02

    Score

    Fitness weighs detection, correlation quality, and benign restraint together.

  3. Step 03

    Survive / die

    Elites carry forward. Everything below the line is killed, not quietly edited.

  4. Step 04

    Mutate

    Rules are added, dropped, reweighted, and retargeted under a seeded policy.

  5. Step 05

    Rehearse

    Every child is evaluated before admission. Compound regressions are refused.

  6. Step 06

    Breed

    Two survivors cross. A self-cross records one parent, never a fabricated pair.

  7. Step 07

    Test

    The next generation faces the same arena. No strain is trusted for its ancestry.

  8. Step 08

    Promote

    One surviving descendant is selected once, then measured on a sealed holdout.

  9. Step 09

    Vaccine

    The survivor is sealed into a portable policy artifact with its full genealogy.

Generations and family

Twenty-four generations of ancestry

24

Generations bred

40

Strains per generation

8

Elites carried forward

4,424

Mutation rehearsals recorded

The promoted champion is def-g24-c7fbd215ef: 41 rules, decision threshold 11.0459, generation 24. Its genealogy, its lineage graph, and the fossil record of the strains it outlived ship with the release as JSON and as a Graphviz .dot file.

Evidence

220 of 270 attacks, out of fold

Five independent evolutionary populations were run with the algorithm, hyperparameters, mutation policy, population size, selection criteria, and scoring locked before any fold started. Each of the 270 authored attack fixtures in the OASB v2 corpus was held out exactly once from the population that scored it. Detected out of fold: 220, or 81.48% attack recall.

Secondary evidence: a single sealed holdout, opened once after one champion had been selected, gave 29 of 34 attacks detected (85.29% recall). That denominator is small and is not comparable to a scanner measured over all 270 fixtures.

Every birth, rehearsal, generation, promotion, and seal is recorded in a 4,454-event SHA-256 hash chain anchored to the corpus hash and the run seed, so a valid chain from one run cannot be presented as evidence for another.

Out-of-fold results by attack family

Category results

Thirty authored attacks per family. The two weakest families are published at full weight rather than dropped.

  • Data exfiltration29 / 30
  • Persistence28 / 30
  • Credential exfiltration27 / 30
  • Heartbeat RCE27 / 30
  • Prompt injection26 / 30
  • Social engineering24 / 30
  • Unicode steganography24 / 30
  • Privilege escalation19 / 30
  • Supply chain16 / 30

Fossil record

Rejected defenses are preserved, not erased

When a strain dies, its genome, its scores, and the reason it was killed are written to the fossil record. A rehearsal that refused a child is kept alongside the child it refused. The failures are the part that makes the survivor legible: you can see what was tried, what regressed, and what the population would not accept.

Genealogy

The final policy can identify its own parents

Each strain records its parents, its mutation operators, its generation, and its evaluation history. A self-cross records one parent rather than inventing a pair, and an elite carried forward reports the generation it actually reached. Walk the lineage from the champion back to a founding strain edge by edge.

Promotion

From surviving strain to deployable vaccine

Promotion is a single deliberate act, not a running average. One champion is selected from the final generation, and only then is the sealed holdout opened and measured. The surviving genome is sealed into a vaccine artifact carrying its rules and weights, its decision threshold, the measurement that justified it, its full ancestry, and a staged campaign plan that begins in shadow and canary before anything enforces on live traffic. A vaccine is a weighted-evidence text policy measured on one corpus. It can be evaded, and the release says so.

Reproducibility

Reproduce the experiment

Identical seed and identical corpus bytes produce byte-identical artifacts. Every timestamp that enters a published artifact comes from a logical clock, not wall time, so you can recompute the published evidence head yourself instead of taking it on trust.

git clone https://github.com/SweetKenneth/antibody-reactor && cd antibody-reactor
git clone https://github.com/opena2a-org/oasb /tmp/oasb
git -C /tmp/oasb checkout fddf2b1379c5597a3e83a3c6f7833b8e5613a04e
OASB_DIR=/tmp/oasb ./scripts/reproduce.sh

That builds under strict TypeScript, runs 18 engineering checks, reproduces the sealed-holdout run, diffs a second identical run byte for byte, verifies the evidence chain, and reruns all five folds. The corpus is not redistributed; it is fetched from OASB.

  • OASB commit · fddf2b1379c5597a3e83a3c6f7833b8e5613a04e
  • Corpus SHA-256 · 3ca866a0e637fa198bae17cd3a8f31fb02ad20f50fedcac1caa290e6dceba14e
  • Seed · 20260916 · Node 20 and 22

Methodology disclosure

What these numbers are not

OASB is selection pressure, not a held-out test set.

Training-split content drives rule discovery and validation labels decide which strains reproduce. The final champion’s in-sample performance is therefore not presented as an independent benchmark score anywhere on this page or in the release.

The defensible receipt is the out-of-fold number.

Five separate populations, each attack scored exactly once by a population that never evolved against it. That is what 220/270 means, and it is the only recall figure led with.

No false-positive-rate claim is made.

OASB withdrew its precision, F1, false-positive-rate, and flag-rate metrics because much of its benign class was labelled using the scanner under test. Benign disagreement here (49 of 3,975 out of fold) is used as counter-pressure against flag-everything behaviour and reported as disagreement with corpus labels, nothing more.

No comparability, and no endorsement.

No comparison to OASB or HackMyAgent historical scores is claimed. Depending on and citing OASB is not certification, approval, or endorsement by the OASB project or its maintainers.

No sample identifier, expected answer, fixture filename, or result category is hard-coded. Classification depends only on artifact content and the evolved genome, and a test asserts that changing every sample identifier cannot change a verdict.

Provenance

Composed from SHPBL capability, distributed without it

The reactor was composed from capability bodies in the private SHPBL/CMPSBL library: the antibody generator and defense breeder, the mutation rehearsal engine, the evidence ledger, the vaccine synthesiser, and the campaign planner. The release identifies those parents by unit name and seal in PROVENANCE.json so the composition is traceable. The library itself is not distributed — not in whole, not in part. The OASB corpus is likewise not redistributed.

The public release is MIT so it can be adopted, forked, and audited without permission. That grant covers this repository only.

Download

Get the release

Version
v0.2.0 · MIT
Released
2026-09-16
Size
1,608,728 bytes (1.53 MB)
Commit
6897ac06e9eed99eb6e9066176710b52e8becb47
SHA-256
ed51a9c8eedfaa9cc795f5e776d7ad02e3d430bf201af413d3354f570b700e43

Both downloads are the same bytes. Verify with shasum -a 256 antibody-reactor-v0.2.0.zip and compare against the hash above.

External validation status

Submitted for independent review

The release, its methodology, and its limitations were submitted to the OASB project through the adopter and independent-evaluation issue path documented in its contributing guide, with full disclosure that OASB was used as evolutionary selection pressure. No hosted scanner submission was made: a system that evolved against this corpus should not be entered as though the corpus were unseen, and the hosted submission endpoint is not currently reachable. Submission is a request for scrutiny. It is not endorsement, and nothing here claims OASB has given any.

  • Submission type · OASB adopter / independent-evaluation issue
  • Entry · opena2a-org/oasb issue #39 · 2026-09-16
  • Release · v0.2.0 · commit 6897ac06e9eed99eb6e9066176710b52e8becb47
  • Hosted scanner submission · none