Exploit Chains Era

Pretty much all effort today, human or agentic, is spent handling vulnerability signals one at a time. While this isn't wrong, it's not complete. As we should never forget, "defenders think in lists, attackers think in graphs."

Pixee has, over time, come to automate threat modeling for systems, and deeply triage results from many different tools -- SAST, SCA, IAST, DAST, secrets, infra, etc.

With this context, we're proud to announce the next step in Pixee's journey: to take all the disparate signals we've collected, find the dangerous chains, and fix them, before attackers can.

Case Study: JuiceShop Cross-Origin DAST + SAST complete data exfil of user testing locally

Here are real results of our Exploit Chain Agent in action on OWASP JuiceShop given fresh opengrep and Zap results:

Given the nature of JuiceShop, I'm not surprised at the number of chains – it's got a nice set of primitives to play with! It finds many ways to chain together bugs along the expected vector of the threat model: user attacks server running on localhost, and server gets pwned.

My favorite chain cuts a more unexpected path. If a user is testing JuiceShop, they might not think they're unsafe to browse the web at the same time. After all, if you're learning about security, and you're trying to figure something out, you might want to have a few tabs or chatgpt.com open.

The threat model we continuously generate and feed as context hints to the agent that "hey, a human developer/security person runs JuiceShop locally to learn about vulns", are there any undue threats along that vector?

Given the hints, it finds a chain that is pretty cool. Our agent combines 2 DAST findings and a SAST finding in order to compromise the user running JuiceShop, remotely. This issue is similar in nature to a chain-based CVE that Pixee (h/t Matt Austin) discovered in Burp in 2021.

Here are the steps the agent lays out:

1. Victim is running JuiceShop, but doesn't need it opened.
2. Victim visits attacker-controlled website. Attacker hosts a page that runs JavaScript to fetch() the victim's Juice Shop instance (e.g., http://localhost:3000/ or an internal hostname).
3. Browser performs cross-origin reads due to wildcard CORS. Because server.ts applies app.use(cors()) globally, the JuiceShop responses are readable by arbitrary origins in the browser context as SOP is relaxed.
4. Exfiltrate sensitive unauthenticated resources. The attacker's JS reads and exfiltrates: (a) /rest/admin/application-configuration (includes internal/private URIs/IPs in config) and (b) directory listings from /encryptionkeys and /support/logs to pivot into bulk file downloads.
5. Use disclosed internal details to deepen compromise. Leaked config values (redirect URIs, internal addresses) and enumerated key/log artifacts can be used for targeted phishing, environment pivoting, and to accelerate exploitation of other weaknesses.

Individually, these findings might get talked down or triaged into the backlog. CORS imperfections are the classic "informational" finding. The exposed endpoints are "internal only, not reachable from the internet." Chained together, it means anyone running JuiceShop can be compromised by any page on the Internet.

Just like there's a massive vuln discovery uptick in OSS now, I predict when researchers (and agents) start thinking in "chains" (graphs), we'll see another massive uptick. The numbers on that first uptick are not subtle: GitHub's Advisory Database went from roughly 270 reviewed advisories a month in 2024 to 1,560 in May 2026, more than five times its typical output and the highest in its history, with CVE requests to their CNA hitting nearly 4,000 in May alone.

If you want to scale exploit chain discovery, call us.