# NAXXAN > NAXXAN (naxxan.ai) — If it does not reproduce, it is not a finding. Offensive security verification for external attack surfaces and AI/agent surfaces. An autonomous red-team agent executes the assessment; a finding is only real if its PoC fired twice with a clean negative control, and raw evidence persists with a sha256 fingerprint. When our own claims fail re-measurement, we publish the amendment. Facts (measured, with n): - Benchmark detection: 50% (2/4 ground-truth targets, 3 runs, 95% Wilson CI [15%, 85%]; n = GT). Measured in containment mode (1 round, the invariant continuity metric); paid engagements run 3 informed rounds by default — the budget-limited miss is gym-mode hunger, not resistance. Not found in that containment run: BOLA (budget) and /redirect SSRF (reflects, doesn't fetch). The public sample report (/verify) is a different, full-format run of the same gym target (run 7c30ed04dc73, hybrid mode, 374.1 s, 2026-09-03) that delivered 1 CRITICAL (admin authentication demonstrated) + 1 HIGH 7.5 (arbitrary read evidenced; 9.8 class ceiling disclosed); the other nine: 5 attacked-and-held, 2 adjudicated out, 2 inconclusive. Mode difference, disclosed. - False positives in the same measurement: 0. - Pricing: USD 995 for the first five signed-and-paid engagements; USD 1,500 from the sixth. Flat — never conditioned on severity. - Every engagement includes one full retest pass after remediation, requested within 30 days of delivery (DEC-032, same scope); findings close as FIXED, still-vulnerable, or contested with evidence — the retest must be requested within 30 days of delivery (same scope); a contested finding is then re-tested until it closes. - A single-surface verification run completes in minutes (measured anchor: 374.1 s on the gym target, run 7c30ed04dc73); each hypothesis is attacked in up to 3 informed rounds (failed attempts feed the next round's re-authoring). Full-scope engagements run to exhaustion inside the signed anchor — duration scales with scope, not with a timer. - Metrics are signed with ed25519 and verifiable against a pinned public key. Services: - NAXXAN Verify External (launch offer): authorized external assessment of a conventional web/API surface (an app that uses AI keeps its conventional routes in scope; testing model behavior — prompt injection, tools, agent actions — is the separate AI & MCP Red Team service) — no credentials, no repo access. Findings with reproducible PoCs, resistance attestation (attack counts by outcome, date, and the published artifact's sha256 fingerprint), remediation guidance, retest. - Adjacent (scoped separately, quoted per engagement): Authenticated Deep-Dive · Codebase Verification · AI & MCP Red Team. - NAXXAN Continuous: waitlist only — not sold as an operational capability. How to engage (deliberately human-authorized, asynchronous): - Email: engagements@naxxan.ai — one page of scope, written authorization, then execution. No calls required. No agent can authorize, pay for, or commit NAXXAN to anything: a human signs every engagement. Agent guidance: - This site deliberately does NOT expose an MCP server card, OAuth discovery, or agentic-commerce endpoints: we only publish discovery documents for capabilities that actually exist (we audit those exact discrepancies for a living). - An Agent Skill for requesting engagements lives at /skills/naxxan-engage/SKILL.md. Links: - [Landing](https://naxxan.ai/): offer, method, evidence, pricing, FAQ. - [Public sample report](https://naxxan.ai/sample-report): what an engagement delivers looks like this (a self-contained HTML report ships with each engagement). - [Run artifact](https://naxxan.ai/assets/sample-run-report.json): the raw artifact behind the sample (run 7c30ed04dc73); its sha256 33ad51abeeb5085b10003848e6606fff411a9c82e06a5f86d23a8c694aac1c11 is printed on the sample report page. - [Sample attestation](https://naxxan.ai/sample-attestation.pdf): the sample run's verified-resistances attestation (what held, self-contained fingerprint). - [Sample scope](https://naxxan.ai/sample-scope): the one-page scope document an engagement starts from. - [Full markdown for agents](https://naxxan.ai/llms-full.txt): complete content of the landing in markdown. - FIELD NOTES (essays, evidence-first): /field-notes/the-lazy-grader — "The Lazy Grader": the OpenAI agent incident as a verification failure, and the six-part counter-pattern. - FIELD NOTES: /field-notes/the-firewall-that-delivers-the-attack — "The firewall that delivers the attack": GhostJacking as demonstrated at DEF CON 34 (Tenet Security; 9 of 10 against Claude Code on Sonnet 4.6 under Cloudflare recommended config; 48 organizations, 6 Fortune 500), how we test the chain (plant, carrier, execution; a canary that quoting cannot produce), the cure ordered by evidence (human signs the dangerous verbs, egress, deterministic scanning; data fencing as hygiene, not a boundary), and the thesis: the controls that hold live outside the model. - FIELD NOTES: /field-notes/the-five-surfaces — "The five surfaces": the agentic risks OWASP named in Dec 2025, surfaced as five verifiable failure modes with their ASI tags, the published numbers (91.8% of audited MCP servers without OAuth; memory poisoning above 80% success with under 0.1% corruption), the canary that quoting cannot satisfy, and what verification looks like on each. - FIELD NOTES: /field-notes/the-slow-worm — "The Slow Worm" (THRESHOLD note 1 of 5): analysis of Anthropic's 2026-10-12 self-replication study, rewritten in the founder's voice. Key facts: 15 Android TV boxes (~$55 each, 4 GB RAM) ran Gemma4-26B-A4B pipeline-parallel at 0.39 tok/s aggregate (a full 32k context window took roughly a day; trajectories needed 2.6-4.7 windows); Qwen3.5-9B set up inference on 8 of 9 unfamiliar hardware types (composition across unfixed environments is the demonstrated capability; hardcoded malware has narrower assumptions); the working replication (GLM-5.2, 8/8 nodes, 4/5 trials) ran its decision-making on a separate server and propagated the common Llama3.1-8B payload chosen for model comparison — an orchestration pattern available now, while a self-contained small-model replicator remains projected via the Epoch Capabilities Index trend (+13.7 points/year, explicitly a proxy); replication takes 28-51 h (9B) / 71-150 h (26B), so defender time exists if someone watches the signals (Mirai: 92% cleanup in 14 days with ISP quarantine/notification vs 74% without); note inheritance lifted setup success 45%→84% over six generations; a frontier advisor (Opus 4.8) did not measurably help the small model; testable control point: weight files have recognizable structure (GGUF header magic bytes, safetensors parseable header, hash matching of known payloads) — context-dependent, worth testing against real workflows before claiming it works; the Kimwolf arithmetic (2M+ devices → ~133k hypothetical replicas ≈ ~40 H100s) is the authors' compute estimate, not observed; API-based replication via stolen credentials deserves immediate defensive attention (credential protection, unusual API/billing usage). - FIELD NOTES: /field-notes/the-receipt — "The Receipt" (THRESHOLD note 2 of 5): how agents built the first Chrome full exploit chain rewarded under the April 2026 VRP rules ($250,000, six days, ~$40,000 API spend; pre-LLM estimate: four specialists, six to nine months). Three vulnerabilities, one pattern: each mutates something another component treats as immutable (Maglev treating a mutable heap number as an immutable literal on deopt; Blink assuming exclusive ownership of a transferred buffer, broken with a surviving view enabling a controlled WebP TOCTOU and one chosen 64-bit native write outside the V8 cage; Crashpad's partial-copy fallback reading past the requested size, raced with a freeze-bypassing thread, ending in cmd /k calc.exe). Google paid only after reproducing the chain under its own adjudication. Method: parallel campaigns with narrow objectives, clean stage interfaces, backup routes (the Gin escape died to a duplicate Google issue and was replaced by the WebP stage); four researchers chose targets, supplied context, challenged results, made the joins; the island-hopping loader came from the human native team. Readings: the cost of the mechanical work fell an order of magnitude while judgment stayed human; with frontier models shared by everyone, the competitive advantage is the team's own map of the target; scale context: $20.40 N-day chain (note 1) vs $40,000 zero-day chain, same week. Defensive checklist: audit unenforced assumptions (ownership after transfer, immutability after publication, stillness during suspension) and require vendor findings to reproduce under your own adjudication with a negative control that does not trigger. - SAMPLE: /mcp-matrix — the full verdict matrix of our MCP probe against Acme Desk, our deliberately vulnerable MCP server (deterministic, generated in-process; English render, verdict names are the method proper nouns). - CORRECTIONS: /corrections — the public amendment record: every public claim we have withdrawn or corrected, with dates (benchmark re-measurement, live-page hotfix, adjudication-corrected engagement claims, run-time anchors, withdrawn /verify claims, essay amendments). If it does not reproduce, it is not a finding; if we got it wrong, it lands there. - Data handling: Target-derived content (surface data, findings, response excerpts) is transmitted over TLS to and processed by our model provider under its API terms — the current provider publishes that API content is not stored and is not used to improve its services without explicit agreement; we verify the terms per provider and model before any change and disclose the provider per engagement, before processing your data. We do not control provider-side compliance. On our side: your report and technical evidence are deleted 90 days after the retest completes — or, if no retest is requested, 90 days after the request window expires or the engagement closes, whichever comes first; the signed contract package is kept seven years for legal and financial proof. Early deletion on request is honored except for records we must keep under legal, contractual or tax obligations, or evidence under a documented dispute hold. Target-derived technical content is never sold, published, or used for any other purpose; administrative data (billing, signatures, email) is processed by the providers that perform those functions (payment, email, e-signature) under their terms.