FAST: A Standard for How Agents Report Vulns

Autonomous hacking agents are getting good at finding bugs. They're not good at reporting or classifying them.

Drop FAST into your agent. It'll stop reporting leads as vulnerabilities, classify severity based on what programs actually pay for, and generate reports that actually get accepted.

This is an accuracy problem, not a capability problem. The agents can find things. They just don't know which things are worth reporting, at what severity, or how to write them up so a triager can reproduce in two minutes.

What FAST is

FAST (Framework for Autonomous Severity and Triage) is a severity classification standard for autonomous hacking and triage agents. It's a set of Markdown files you drop into your agent's context. Once loaded, the agent knows:

• The difference between a lead and a vulnerability. A lead is unproven, a token in a JS file, a reflected parameter, a scanner hit. A vulnerability has reproducible proof of impact. Most rejected reports are leads submitted prematurely. FAST stops that at the source.

• How to classify severity. One decision tree, walked top to bottom. RCE is critical. SSRF with internal data is high. Stored XSS is medium. The tree is derived from what programs actually pay for, not from CVSS math.

• When to report. A six-check gate: proof, unauthorized access, reproducibility, obvious impact, blast radius, and confirmation it's a vulnerability not a lead. Any NO and the agent keeps investigating or discards the finding.

• How to write the report. Title format, section order, PoC format by target type (HTTP, curl, Python, ADB, AWS CLI, PowerShell), and a list of things to never write ("potential", "might be", "could be").

  
  

Covers both sides of the problem

FAST is dual-audience. The same standard governs hacking agents that generate reports and triage agents that evaluate them. When both sides use the same rules, the hacker writes reports the triager finds obvious, and the triager's verdict matches the hacker's classification.

Before every submission, the agent asks: "If I were the triager reading this, would I agree?" If the answer is no, either the evidence is missing or the severity is wrong.

Where it comes from

Every rule in FAST is grounded in real triage outcomes — what programs actually paid for and what security teams actually accepted as a vulnerability worth fixing. Not theoretical scoring, not CVSS committees, not "OWASP says so."

The standard was built from a private corpus of real vulnerability reports spanning multiple years, across web, mobile, desktop, and cloud targets. The corpus isn't public, but the rules derived from it are. The methodology explains how the rules were extracted and how to challenge them with your own data.

How to use it

Clone the repo and drop it into your hacking or triage agent, done.

$ git clone https://github.com/ObvaneGroup/Fast-Standard.git

Your agent uses the rules, guardrails and report template. The decision tree tells it how to classify, the report gate tells it when to submit, and the template tells it how to write it up. No integration, no code changes.

The goal

Agents stop submitting leads as vulnerabilities. Severity classifications match what programs actually triage to. Reports land with proof, blast radius, and a structure triagers can reproduce in under two minutes.

Fewer informatives. Fewer downgrades. Less noise in the queue for everyone.

Open standard

FAST is CC-BY 4.0. Use it, adapt it, build on it. If your triage data confirms or contradicts a rule, open a PR. Every contribution sharpens the standard, and every agent using it gets more accurate.

github.com/ObvaneGroup/Fast-Standard