{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreihtta3loslsheyhi2cjee3mby4i4et4wnuigtzphjm7v476rczzf4",
    "uri": "at://did:plc:25rdn5elo5izoxrmtis34zuk/app.bsky.feed.post/3mpt7xj2lhe22"
  },
  "coverImage": {
    "$type": "blob",
    "ref": {
      "$link": "bafkreid7fnk7tzc2pg7mqy2g54w6o7yjm4debjdoocpw7rfdhonut25tnq"
    },
    "mimeType": "image/webp",
    "size": 63532
  },
  "path": "/astaaddahiya/building-a-10-agent-security-civilization-with-qwen-and-alibaba-cloud-4i21",
  "publishedAt": "2026-07-04T13:24:56.000Z",
  "site": "https://dev.to",
  "tags": [
    "ai",
    "alibabacloud",
    "hackathon",
    "qwencloud"
  ],
  "textContent": "Security auditing is broken.\n\nIf you’ve ever run a static analysis tool (SAST) on a large codebase, you know the pain: thousands of alerts, zero context, and a 90% false-positive rate. On the other end of the spectrum, hiring human penetration testers is incredibly expensive and impossible to scale alongside modern CI/CD pipelines.\n\nFor the **Qwen Cloud Global AI Hackathon** , we decided to rethink the problem entirely. What if, instead of using a single monolithic AI to \"find bugs,\" we built an entire specialized _civilization_ of agents?\n\nMeet **NEXUS** , an autonomous society of 10 distinct AI agents that discovers, triages, exploits, patches, and reports security vulnerabilities in real open-source software.\n\n##  🧬 The Agent Civilization\n\nInstead of asking an LLM to \"find a bug and fix it\" (which usually results in hallucinations), we split the vulnerability lifecycle into 10 distinct, highly-specialized roles.\n\nPowered by the **DashScope API** (using `Qwen-Max` and `Qwen-Plus`), our pipeline looks like this:\n\n  1. 🔍 **Scout (`Qwen-Plus`):** Crawls GitHub and maps the repository's file structure.\n  2. 📊 **Recon (`Qwen-Plus`):** Analyzes the attack surface, identifying high-risk entry points (auth middleware, raw SQL queries, etc.).\n  3. 🎯 **Hunter (`Qwen-Max`):** Performs deep codebase analysis using Qwen-Max's massive 1M token context window.\n  4. 💥 **Exploit (`Qwen-Max`):** Generates safe, proof-of-concept (PoC) code to cryptographically prove the vulnerability is real.\n  5. ✅ **Verify (`Qwen-Max`):** Acts as a skeptic, cross-validating the PoC to eliminate false positives.\n  6. ⚖️ **Governance (3 Agents):** A council of three distinct personas (CVSS Scorer, Impact Assessor, Exploitability Judge) that debate and vote on the vulnerability's severity.\n  7. 🔧 **Patch (`Qwen-Max`):** Generates an AST-aware security fix with regression tests.\n  8. 👁️ **Review (`Qwen-Max`):** Ensures the patch is clean and doesn't break existing functionality.\n  9. 📝 **Report (`Qwen-Plus`):** Generates a CVE-ready security advisory.\n\n\n\nBy forcing the system to generate a PoC and independently verify it, we shifted from a model of _guessing_ bugs to _proving_ them. **Zero false positives by design.**\n\n##  🏛️ The Governance Council\n\nOne of the coolest features we built is the **Governance Council**.\n\nWhen the Hunter agent finds a verified vulnerability, we don't just ask a single LLM to rate its severity. Instead, we spin up three distinct agents with completely different system prompts:\n\n  * **The CVSS Scorer:** Obsessed with the technical vector (Network vs. Local, High vs. Low complexity).\n  * **The Impact Assessor:** Focuses entirely on business logic (Can this leak PII? Can this take down the database?).\n  * **The Exploitability Judge:** Looks at how easy it is for a script kiddie to actually pull this off in the wild.\n\n\n\nThese three agents independently evaluate the finding, and the orchestrator mathematically averages their scores to reach a consensus. Watching them debate a vulnerability in real-time on our dashboard feels like a glimpse into the future of autonomous organizations.\n\n##  🧠 The 3-Tier Memory System\n\nTo make NEXUS actually _learn_ from its scans, we couldn't just rely on context windows. We built a 3-tier memory engine:\n\n  1. **L1 Working Memory (Redis):** Handles real-time agent communication and short-term context. We also use Redis PubSub to stream agent \"thoughts\" live via WebSockets to our frontend dashboard.\n  2. **L2 Episodic Memory (PostgreSQL):** Permanent, relational storage of scan results, exact PoC code, and historical governance votes.\n  3. **L3 Semantic Memory (`pgvector`):** This is where it gets interesting. When NEXUS successfully exploits a bug, it generates a vector embedding of that specific code pattern. Before scanning a new file, it performs a similarity search against `pgvector`. Over time, NEXUS actively learns what vulnerabilities \"look\" like across different codebases.\n\n\n\n##  ☁️ Powered by Alibaba Cloud\n\nNEXUS isn't just an API wrapper; it's deeply integrated into the Alibaba Cloud ecosystem.\n\n  * **Intelligence:** We rely entirely on the `dashscope-intl.aliyuncs.com` API for Qwen inference. We routed high-reasoning tasks to `Qwen-Max` and summarization/routing tasks to `Qwen-Plus` to optimize our API credits.\n  * **Artifact Storage:** Security advisories and exploit artifacts are highly sensitive. We integrated the `oss2` Python SDK so that the moment the Report agent finishes its job, the final Markdown advisory is immutably uploaded to **Alibaba Cloud Object Storage Service (OSS)**.\n  * **Deployment:** The FastAPI backend, ARQ worker queues, and PostgreSQL/Redis databases are deployed seamlessly via Docker Compose onto **Elastic Compute Service (ECS)** instances.\n\n\n\n##  🚀 The Result\n\nWe built a Next.js \"Mission Control\" dashboard that connects to our backend via WebSockets. When you paste a GitHub URL into NEXUS, you get to sit back and watch 10 AI agents systematically dismantle, exploit, and patch the codebase in real-time.\n\nBuilding NEXUS taught us that the future of AI isn't a single, omniscient chatbot. It's specialized, communicative, and governed societies of agents working together to solve problems that humans simply don't have the scale to tackle alone.\n\n_Built for the Qwen Cloud Global AI Hackathon 2026. Check out the code on GitHub!_",
  "title": "Building a 10-Agent Security Civilization with Qwen and Alibaba Cloud 🛡️🤖"
}