Time Table

Most LLM security agents stuff context into a prompt and hope. As the engagement grows, the context rots: the model drops an early finding, invents a vulnerability, and burns an unpredictable budget. Everyone rebuilds the same scaffolding, and none of it is trainable.

Recursive Language Models work differently: context lives as variables in a sandboxed REPL, and the model reasons over it in code with recursive sub-calls. rlm-harness is my open-source harness over DSPy’s RLM: declare a task and inherit the sandbox, replayable traces, and reward-free dataset export.

Three agents run on it. cve-reverser turns a disclosed CVE patch into a lab PoC and a Nuclei template. diff-sentry reads a GitHub diff as untrusted data and flags malicious changes before they land. sc-sentry hunts Solidity vulnerabilities class by class: static analysis narrows the model to candidate sites, every finding must quote the lines it cites, and the output is SARIF, measured on the contract-assay benchmark rather than demoed.

The harness, not the model, carries the task structure, so one trained planner transfers across security domains. You work on the task, not on machine learning.