Tenderizing the Target: Soaking Code in Synthetic Vulnerabilities

No ratings

Presented at [un]prompted 2026 by

Aaron Grattafiori

Skyler Bingham

Marinade is an agentic workflow we built to solve a fundamental problem in security testing: getting realistic vulnerable applications that aren't contrived CTF challenges or overused training targets like DVWA. The idea is to point it at some source code—Django, Spring Boot, Java, Rails, whatever—and it works to analyze the codebase, understand the attack surface, and inject realistic, exploitable vulnerabilities that blend naturally into the existing code while preserving functionality. We’ve found that AI is surprisingly adept at weakening security controls rather than clumsily removing them, producing bugs that look like genuine developer mistakes in a given programming language or app, and each injected vulnerability ships with a validation script proving exploitability to avoid false positives. Marinade lets you generate a large-scale synthetic corpus of vulnerable applications from real-world, production-quality codebases opening up new possibilities for scanner evaluation, red team training, and security tool benchmarking.