originsec/pocsmith

pocsmith is a Python-based security research tool that automates the process of writing and testing Windows exploit proof-of-concepts (POCs). A POC in security research is a demonstration that a software vulnerability can actually be exploited, it proves the bug is real and shows how an attacker might use it. pocsmith takes a vulnerability report (produced by a companion tool called patchwatch, which analyzes Windows patches to find what changed) and then uses an AI agent powered by Claude to automatically write exploit code, compile it, deploy it to a controlled virtual machine, run it, and verify whether it worked. The system connects several specialized tools together: a Hyper-V virtual machine manager for spinning up isolated Windows environments, a remote kernel debugger for inspecting what happens inside the Windows kernel during an exploit attempt, and Ghidra (a reverse-engineering tool) for analyzing the vulnerable binary. The AI agent works through these tools in a loop, reading the vulnerability context, generating code, compiling it using Visual Studio, running it inside the VM, checking whether it caused the expected crash or primitive, and adjusting its approach based on the results. This is designed for security researchers who are authorized to test Windows vulnerabilities on their own infrastructure. It runs entirely locally, the only external connection is to Anthropic's API for the AI reasoning. You would use it to accelerate the time-intensive work of turning a patch-diff into a working exploit demonstration. Prerequisites are significant: a Windows 11 host with Hyper-V, Visual Studio 2022, Windows SDK, and Docker. The full README is longer than what was provided.