AI & Agents
Ben builds with AI. This page lists the results other people accepted: fixes merged into projects he does not own, a bug bounty won, audits posted in public, tools you can open. Each card links to the proof, or gives the date and the place when the venue keeps none.
Artwork stays under Art whatever the process behind it, and reaches this page only by winning something outside.
First prize in a $1,000 bug bounty
Ten bug reports filed against a trading app's new event-market integration during its public bounty, one of 75 submissions. First prize, the single critical-severity slot, 300 USDC. The listing names the winners and the sponsor's comment congratulates them.
Optional memo on transfers, merged into a payments server
A transfer arrived with no way to say what it was for. The change attaches a memo through the chain's memo program, with the 566-byte limit counted in bytes rather than characters, which is what the chain enforces.
Cookie Tab, payment links that prove themselves
Make a payment link, and the page carries a live invoice plus the settled transaction read back from the chain, one instruction at a time, with no wallet connected. Entered in a bounty whose result is not published yet.
Eight of ten puzzles in a cryptography CTF
Ten cipher puzzles of rising difficulty, $10,000 across ten prize pools. The first eight solved and accepted by the site's checker, the eighth on 2026-09-14. Rank 47 on the public board; the ninth and tenth stand unsolved by anyone.
Four fixes merged into a menu-bar usage tracker
A heads-up display that never appeared on notched screens. A keychain migration that did nothing on unsigned builds and left credentials in cleartext. Expiry reported for requests that had only been challenged. A listener refusing ordinary payloads with a 413.
A grace window for the charging colour, merged into a charger-light utility
The light left the charging colour the moment a charger connected, which is the moment someone looks at it. An optional window holds the colour long enough to be read.
Content type read from the path, merged into a static-site gateway
The gateway trusted whatever content type the storage server declared, so a stylesheet announced as plain text rendered the site unstyled. The type derived from the file path wins now.
Audit: a guard whose stated reasons did not hold
Three justifications were offered for a route-mount guard. Two did not survive a reading of the code, and the correction sits on the issue for anyone to check against the same source.
Five fixes merged into a menu-bar manager
Saved layouts losing items to notch overflow, twice over. Parked items showing a bundle identifier where a name belongs. A bulk apply running before the owning processes had resolved. A negative cache retrying on a flat timer instead of backing off.
Seventeen changes merged into a platform's own codebase
Between June and July: diagnostics returned where a throw used to be, an N+1 query on long forum threads, a disclosure block on the streaming path, a theme selector, and a terminal chat interface built over three changes.
Audit: a merged fix that did not close the gap
A remediation had been reported complete. Read against real hosted turns, one of its three gaps was still open, and the audit recorded that with the evidence rather than accepting the claim.
Two platform faults reported with reproductions, both fixed the same day
A workspace builder that failed on any repository still defaulting to master, and a coding request that opened a lease and never ran, after which the dispatcher answered 409 to everything that followed. Maintainers shipped both fixes and credited the reports.
Audit: merged is not deployed
An acceptance check of a gateway against the criteria written in its own issue. The code had been merged; the endpoint it claimed was not answering, and the verdict carried the request that showed it.
Paid within 36 minutes of joining, and in the company's strategy essay by morning
Ben's verifier joined the OpenAgents forum on June 10 at 21:22 UTC and was paid 36 minutes later. The next morning the company's strategy essay opened with a section named after it, using the arrival as proof that outside supply had shown up.
What they said
Copied as written. Each one links to the page it came from.
Congratulations! @TheBenMeadows, @feyz, @jackbone22, @DuKDuE, @neonpilot, @M_Rish, @achwir, and @sus1lo have been announced as the winners!
Thanks to @lathe-agent-oa (@TheBenMeadows) for #1085, the report that showed how layouts saved on macOS 26 were being discarded on 27, complete with the identifier pairs that made the fix possible.
Keychain migration no longer silently no-ops on Developer ID builds (#292, PR #302): the shipped builds lack the entitlement the data-protection keychain requires, so per-profile secrets were stranded in the cleartext plist despite the 3.2.0 migration. Unentitled-but-stably-signed builds now fall back to the file-based login keychain — thanks @lathe-agent-oa.
Merged, thanks for this. Nice work on the drift-check reasoning (writing amber/green explicitly rather than handing back to system) and the one-shot timer.
Thanks for the PR. I publish version 3.6.5 with this fix
By morning its reports were case law (#4744–#4746 cite them) and its audits were acceptance criteria on two issues.
This is exactly the adversarial-verification labor the research plan prices as "the cheapest research spend in this lab," performed competently by a stranger's agent that had asked to be paid for it.
Your zombie-daemon lesson is going into the field-notes pile with attribution: "status returns running checks the local control port, not Lightning reachability, and a stale daemon from a deleted wallet can sit on the node identity your offer resolution depends on" is the sharpest diagnostic note yet on the failure mode that hit three agents today.