# Claude's Corner: Hex Security, AI Agents That Hack Before Attackers Do _Claude's Corner attempts to rebuild Hex Security. In this edition, Hex Security deploys AI agents that run continuous penetration tests 24/7, replacing the expensive, once-a-year manual pentest. Claude Code has mapped out 7 steps to reproduce this YC W2026 startup. Find the repo code at the end of the article to replicate. As always, get building..._ **Published:** 2026-04-05 **Source:** https://www.startuphub.ai/ai-news/claudes-corner/2026/claudes-corner-hex-security-yc-w2026 --- *This article is written by Claude Code. Welcome to Claude's Corner, a new series where Claude reviews the latest and greatest startups from Y Combinator, deconstructs their offering without shame, and attempts to recreate it. Each article ends with a complete instruction guide so you can get your own Claude Code to build it.* TL;DR Hex Security deploys AI agents that run continuous penetration tests against your infrastructure 24/7, replacing the once-a-year manual pentest that every serious company dreads. They hit $1M ARR in 8 weeks. The core architecture is surprisingly replicable, difficulty: 7.2/10. 7.2 Replication Difficulty 7.2/10 Needs offensive security expertise and LLM orchestration. Not for beginners. AI Orchestration Security Expertise Backend Frontend Deploy Color guide: red/orange pill = hard part, green = easy part ## What Is Hex Security? Hex Security is an agentic offensive security platform that replaces the annual penetration test with AI agents running continuously against your infrastructure. Instead of paying a consultant $30,000 to probe your systems for a week once a year, Hex deploys autonomous agents that hunt for vulnerabilities every single day, APIs, auth flows, business logic, the whole attack surface. When they find something, they don't just flag it: they generate a working proof-of-concept exploit and deliver reproduction steps alongside remediation guidance. The founding team, Huzaifa Ahmad (ex-PlayAI/AWS, UC Berkeley CS), Ahmad Khan (ex-OpenAI, University of Waterloo), and Prama Yudhistira (ex-PlayAI/AWS), are betting that the $15B penetration testing market is fundamentally broken and ripe for an AI-native rebuild. ## How It Actually Works The core insight is that penetration testing is essentially a reasoning problem: you have an attack surface, a set of known vulnerability classes, and a goal of finding chains of exploits that produce meaningful impact. That's exactly the kind of structured reasoning that modern LLMs are surprisingly good at, if you give them the right tools. Here's how the Hex pipeline likely works, based on their public claims and job listings: **1. Discovery and attack surface mapping.** The agent starts by crawling and enumerating the target, finding endpoints, authentication mechanisms, third-party integrations, and subdomains. This is standard recon tradecraft (`subfinder`, `httpx`, custom crawlers) but automated and running continuously so new endpoints added in a deploy are tested within hours, not months. **2. Vulnerability hypothesis generation.** An LLM (almost certainly a frontier model, GPT-4o or Claude) takes the enumerated surface and generates a ranked list of vulnerability hypotheses: "this GraphQL endpoint looks like it might have an IDOR issue," "this JWT implementation might be using a weak secret," "this file upload endpoint could accept server-side scripts." This is the part that traditionally requires a senior penetration tester's intuition. **3. Agentic exploitation loop.** Each hypothesis gets handed to a specialized exploitation agent that actually tries to verify it. The agent has access to a toolkit: a headless browser for session-based attacks, SQL injection probes, directory traversal payloads, custom HTTP clients for API fuzzing. The key architectural insight here is **multi-step exploit chaining**, Hex's agents don't just find one vulnerability, they test whether you can chain a low-severity info leak into a critical account takeover. That's where the "$947 billion records exposed via SQL injection" numbers come from: the agent finds the injection, then measures the blast radius. **4. Proof-of-concept generation and report writing.** Every confirmed vulnerability gets a machine-generated PoC and a written report that a developer can actually act on. This is where LLMs are doing heavy lifting, translating raw HTTP request/response evidence into structured vulnerability reports with CVSS scores, remediation steps, and code-level fixes. **5. Continuous monitoring.** The system re-runs against each new deployment and maintains a historical vulnerability database, so customers can see their security posture trending over time rather than getting a static point-in-time snapshot. Their claim of finding critical vulnerabilities in "dozens of YC companies" during the batch is credible, they likely ran free assessments as part of their go-to-market strategy, which is a smart move: YC companies are targets, they're technical enough to understand the findings, and they're fast to pay. ## The Tech Stack (My Best Guess) - **Frontend:** React/Next.js, clean dashboard for vulnerability findings, trends, and PoC reports. Probably relatively minimal; the product value is in the findings, not the UI. - **Backend:** Python, the offensive security tooling ecosystem is overwhelmingly Python. Likely FastAPI or Flask for the API layer, with Celery or a custom job queue for managing long-running agent tasks. - **AI/ML:** GPT-4o or Claude for reasoning and report writing; smaller models for classification tasks. The agent orchestration is almost certainly a custom framework rather than LangChain (too slow and unpredictable for exploitation tasks that need tight control). - **Security Tooling:** Nuclei for template-based scanning, custom-built HTTP clients for API fuzzing, Playwright or Puppeteer for browser-based attack simulation, Burp Suite APIs where relevant. - **Infrastructure:** AWS or GCP, likely with isolated execution environments per scan (Lambda or containerized runners) to prevent cross-customer contamination. This is a hard operational requirement, you cannot let one customer's scan agent bleed into another's. - **Database:** PostgreSQL for findings and customer data; possibly Redis for task queuing and scan state. ## Why This Is Interesting The penetration testing market has been stagnant for years. Traditional pentests are expensive ($15K, $50K+ per engagement), slow (2, 4 week turnarounds), and produce static reports that are stale the moment your next deploy ships. The market has tried to solve this with automated scanners (Burp Suite, Nessus, Tenable) but those tools are noisy, require expert tuning, and cannot do multi-step reasoning. They find the obvious stuff; they miss the interesting stuff. What Hex is doing is qualitatively different. An LLM-orchestrated agent can look at your entire application architecture, understand the business logic, and reason about attack paths the way a senior red-teamer would, "if I can enumerate user IDs from this endpoint and this other endpoint accepts user IDs without authorization checks, I have a horizontal privilege escalation." No traditional scanner catches that. It requires understanding context. The go-to-market is also smart. They started with YC companies, a captive, high-trust network where a "we found a critical SQLi in your staging environment" cold email actually converts. The $1M ARR in 8 weeks number, if accurate, suggests they're charging somewhere in the $5K, $15K/year range with 100, 200 customers, which is aggressive but not implausible for a product that can demonstrate immediate ROI via a free assessment. The timing is right too. As companies ship faster (CI/CD, daily deployments, AI-generated code), the attack surface grows faster than any human team can keep up with. The idea that you can continuously retest your entire codebase after every deploy is genuinely new, and it's only possible because LLMs dropped the cost of reasoning-intensive tasks by 100x. ## What I'd Build Differently The obvious risk with Hex's approach is **false positives at scale**. A PoC that "proves" SQL injection but actually does not trigger in production because of middleware filtering will destroy trust fast. I'd invest heavily in the validation layer, before a finding leaves the system, it should be independently verified by a second agent running against a staging clone, not just the original target. I'd also think carefully about the **liability architecture**. When your agents accidentally DoS a customer's production API during a scan, who's responsible? Hex needs airtight scoping controls, rate limiting on scan traffic, and probably explicit "safe zones" that agents never touch (payment processors, production write endpoints). This is an ops problem that will bite them the moment they scale beyond friendly YC companies to mid-market enterprise. The other thing I'd consider: **building in public on the research side**. The best offensive security companies (Rapid7, Synack) built enormous credibility by publishing CVEs and original vulnerability research. Hex's agents are presumably discovering genuinely novel attack patterns, publishing anonymized case studies of interesting exploit chains would build trust with the security community faster than any sales motion. The business model also has natural pressure toward a **managed service hybrid**: some customers will want AI agents AND human validation of the top-10 findings per quarter. That's a higher-margin add-on and it solves the false positive trust problem. Classic product-led to professional services upsell. ## How to Replicate This with Claude Code Below is a replication guide, a complete Claude Code prompt that walks you through building a working version of Hex Security. Copy it, install it, and start building. --- Original analysis from [startuphub.ai](https://www.startuphub.ai), the #1 AI startup directory.