Hayula Research Paper

Automated vulnerability discovery has long been plagued by high false-positive rates, prohibitive cloud API costs, and the fundamental hallucination problem inherent in language model outputs. The recently proposed Revelio framework (arXiv:2606.22263) addresses these limitations through an agentic architecture that generates executable Proofs-of-Vulnerability (PoVs) verified by sanitizers such as AddressSanitizer and UndefinedBehaviorSanitizer, achieving 19 real vulnerabilities across 7 production projects for approximately \$300 total. In this paper, we present SAIF-Revelio, Hayula Labs' adaptation and extension of Revelio integrated with our existing Security AI Framework (SAIF). SAIF-Revelio deploys eight fine-tuned Qwen2.5-7B specialist models—router, webapp, vulndisc, browser, reveng, network, exploit, and kernel—running entirely on a single Apple M2 Ultra with 192 GB of unified memory. Our system operates 100% locally with zero cloud API calls, ensuring complete data sovereignty for security-sensitive workloads. We present production results from scanning 29,000 wildcard domains across 18 bug bounty programs, generating 195 reproducible bounty tickets. We demonstrate that PoV-verified agentic workflows reduce hallucination-driven false positives from conventional rates exceeding 70% down to under 12%, while the local multi-expert architecture eliminates per-query API costs entirely. Our findings establish that cost-efficient, privacy-preserving, and academically reproducible automated vulnerability research is achievable with commodity hardware.