Black vs VulnFeed

A black-box evaluation of how AI-generated tests find functional bugs in live APIs.

VulnFeed is also a keyless, pay-per-call CVE & EPSS feed over x402, your agent hits a 402, pays a few cents in USDC, and gets structured, exploit-ranked results.

About Black

A black-box evaluation of how AI-generated tests find functional bugs in live APIs. The harder question is whether those tests find bugs. Each system receives only a JSON schema and one valid sample payload, then must generate API test cases that expose failures in a live reference API. The evaluation uses APIEval-20 v1.0, a black-box benchmark contributed by KushoAI. Because KushoAI is also one of the evaluated systems, this report includes the methodology, workflow definitions, repeated-run setup, and robustness checks so readers can understand where the performance difference comes from.

About VulnFeed

VulnFeed is also a keyless, pay-per-call CVE & EPSS feed over x402, your agent hits a 402, pays a few cents in USDC, and gets structured, exploit-ranked results. Top priority: express, the GHSA-29mw vuln has 73% exploit probability. VulnFeed surfaces the ones likely to be used in real attacks. AI agents can pay per request with USDC on Base, no account, no API key, no subscription. # Agent sends request, gets HTTP 402 with payment details # x402 client library handles payment automatically # $0.01 per scan · $0.002 per CVE lookup · $0.05 per monitor # Discovery endpoint: curl https://vulnfeed-api.novadyne.ai/.well-known/x402 Uses the x402 protocol.