The Deep Agent

Hawk-i Deep is the flagship capability: an autonomous agent that does not just match known patterns, it invents new attacks and proves them by running working exploit code.

$ hawki deep ./contracts --sandbox

How the loop works

Deep runs an asynchronous loop, gated by a budget manager:

Planner.next_attack  ->  Executor.execute  ->  memory.record  ->  budget.consume

Each cycle a planner proposes the next attack, an executor attempts it, the outcome is recorded in memory, and the budget is consumed. The loop continues while the budget allows.

Escalating planners

Deep escalates through three planners of increasing creativity:

• RulePlanner - drains the canned, known attack scripts first.
• HybridPlanner - blends known patterns with contract-specific context.
• LLMPlanner - invents novel attacks that the static rules never encoded.

Proof, not just a claim

When the agent reaches for a novel attack, the NovelExecutor uses an LLM code generator to synthesize a Hardhat or Foundry proof-of-concept and runs it inside the Docker sandbox. The output is a reproducible PoC alongside the finding, so an exploit is demonstrated rather than merely asserted.

Pluggable memory

Everything the agent learns is persisted so runs build on each other. Two backends ship:

• SQLiteStore (default) - ~/.hawki/deep_memory.db
• JSONStore - a plain-text JSONL log

Dual budget

The budget is a dual limit: the agent stops when it hits either max_attempts or max_tokens, whichever comes first. Both default to unlimited, so you set the ceiling that fits your run.

$ hawki deep ./contracts --sandbox --max-attempts 25 --max-tokens 200000

Continuous and focused runs

Deep supports a continuous mode for long-running hunts, and a target-contract focus to concentrate the agent on a single contract of interest.