STRATEGIC: hunt UNSWEPT classes, not freshly-disclosed CVEs on popular targets (the yield asymmetry)

Banked: 2026-07-14, cycle307 (PraisonAI SSRF incomplete-fix = DISCLOSED-INFLIGHT/WALK) + cycle305 (Langflow IDOR = FIX-COMPLETE/WALK). Two consecutive fresh-advisory incomplete-fix drills, both WALK.

The asymmetry (the session's clearest strategic signal)

• YIELDED (5 confirmed findings): the AI-agent file-tool GhostApproval class - cline, continue, Amazon Q (dangling-symlink, guard-inconsistency, lexical-boundary). WHY: Wiz's GhostApproval disclosure covered ONLY the big-6 COMMERCIAL tools and left the OSS agents + the sibling residuals UNSWEPT. We mined an unswept slice of a disclosed landscape.
• WALKED (2 fresh CVEs): Langflow CVE-2026-55255 (fix was central/complete) + PraisonAI SSRF CVE-2026-62169 (residual genuinely persists BUT already disclosed + 14+ SSRF advisories on the target = swarmed). WHY: a freshly-disclosed CVE on a POPULAR target draws a swarm that files bypass-of-bypass advisories within DAYS. The incomplete-fix instinct was correct both times; the freshness was already gone.

The rule

Highest-EV incomplete-fix hunting = find a class where a BIG disclosure/research covered only PART of the landscape (one vendor tier, one backend, one endpoint family) and the UNSWEPT part is source-reviewable + creditable. LOW-EV = racing the swarm on a freshly-CVE'd popular target (they've already filed the siblings). - Tell of an UNSWEPT slice: "Wiz/researcher-X disclosed this in the big commercial tools" -> the OSS clones are unswept (GhostApproval); "the advisory names endpoint A" -> sibling endpoints of a SHARED helper (but check if the fix was central first, cycle305). - Tell of a SWARMED surface: N+ advisories of the SAME class on the target in a short window (PraisonAI: 14+ SSRF in June 2026; RAGFlow IDOR earlier) -> DROP entirely (saturated-surface doctrine).

PraisonAI specifically = SATURATED, drop

14+ SSRF advisories June 2026 (GHSA-vg6p/8hjw/5r34/x44h/rg5q/hmfx/6h9p/rjvw/vxgj/4pcv/qg25/6g59...), a swarm actively fuzzing web_crawl/spider/crawl4ai/webhook SSRF + filing patch-bypass advisories. The crawl4ai IP-pin residual is real at HEAD (1.6.150, crawl4ai_tools.py never guarded) but disclosed (CVE-2026-62169 + addendum GHSA-6g59-gm2v-qhvq). Do not mine.

Refinements confirmed this cycle

• cycle305 fix-location predictor VALIDATED: PraisonAI's fix was per-backend (httpx hardened w/ per-hop redirect re-check; crawl4ai path NOT pinned) -> the predictor correctly pointed at the unguarded sibling backend. But disclosure killed it. Predictor works; run it AFTER the disclosure gate on popular targets.
• "advisory prescribes the fix ('should IP-pin') but maintainer ships a partial (string-recheck only)" = a real residual pattern, but on a swarmed target it's disclosed within days. Gate-0 the EXACT file:function before assuming freshness.

Action

Next fresh-target picks: prefer the UNSWEPT-slice-of-a-disclosure shape over racing a fresh CVE. Candidates in that shape: the GhostApproval OSS agents still unswept (void/pearai/zed-agent - apply shell-tool screen), and any big 2026 research that named only some of a landscape.