A few days ago, Binance disclosed a major security incident involving approximately $6.34 billion in impacted digital assets.
Let that sink in for a second. $6.34 billion.
Binance later explained that the attack involved compromised internal systems and unauthorized wallet transactions. The company also said it would absorb the financial impact rather than pass it on to users.
And this isn't just a Binance problem. It's a reminder of how expensive security failures can become, even for companies with dedicated security teams.
Meanwhile, we're in a world where developers are shipping code faster than ever. AI has made building products significantly easier, but security hasn't necessarily caught up with that speed.
More code is being shipped, more products are going live, and vulnerabilities can easily slip through the cracks.
We started thinking: what if teams had a security researcher working alongside them all the time? Someone who could investigate potential vulnerabilities without having to wait for a manual security review.
Well, we decided to try building exactly that.
Meet Hackclawd 🦀
We tried putting an AI security researcher inside Slack that never sleeps, never takes a day off, and doesn't ask for weekends off. 😂
That's basically Hackclawd.
We built an AI-powered bug bounty agent that works directly inside your team's Slack workspace, powered by Switch.
The idea was pretty simple. Developers already spend most of their time collaborating in Slack, so why should security testing feel like an entirely separate workflow?
With Hackclawd, you simply give it an authorized bug bounty program or codebase, and it gets to work.
So, how does it actually work?
Once you mention Hackclawd in a Slack channel and provide the program details and scope, it kicks off its security workflow.
It investigates potential vulnerabilities across different surfaces, including:
- Web applications
- Solidity and smart contracts
- AI systems
But here's where things get interesting.
We didn't want to build another AI tool that scans some code, throws a bunch of suspicious findings at you, and calls it a day.
Hackclawd also validates potential findings by running proof-of-concept code inside an isolated Upstash Box sandbox.
The sandbox has restricted network access, so PoC execution happens against local copies rather than live targets.
Once it's done, Hackclawd sends a report back to Slack containing the potential vulnerability, supporting evidence, proof-of-concept code, and reproduction steps.
Findings remain candidates until a human reviews and confirms them.
Basically, it does the heavy lifting while your team stays in the workflow they're already familiar with.
Building it with Switch
One of the interesting parts of this project was bringing everything together.
We used Switch to connect Slack to our AI agent and manage conversations across channels and threads.
Under the hood, we also integrated:
- Nebius: For the AI model powering the agent.
- Upstash Box: For isolated proof-of-concept execution.
Slack: The interface where teams interact with Hackclawd.
https://github.com/sandbox-quantum/switch?dub_id=mBXLvPIEUER8X8coSwitch: The layer connecting everything together.
Getting these pieces to work together into one workflow was a fun engineering challenge.
What's next?
Hackclawd is our attempt at making security research more accessible and less painful for development teams.
We're not trying to replace security researchers or claim that an AI agent can catch every vulnerability.
We just think teams should have a way to automate more of the tedious work involved in finding and validating bugs.
Because if AI is helping us write code faster, maybe it should also help us find the security issues in that code.
And honestly, having a security researcher in Slack that never asks for a day off sounds pretty cool to us. 😂
Built with Switch.
Check out the project: https://github.com/fozagtx/hackclawd
Top comments (0)