IBM Bob 2.0 Hackathon · September 2026
When a developer fixes a bug, they fix only one copy. Antibody uses IBM Bob 2.0 to hunt the mistake's semantic twins across your repository, proves each one with a failing pytest, and lets autonomous red-team subagents attack custom Semgrep defenses until repository immunity hits 100%.
Interactive Lab Demonstration
Experience how IBM Bob 2.0 isolates the root cause, tests semantic twins in parallel, and pits red-team attacks against blue-team Semgrep rules in isolated git worktrees.
Repository Topology Visualizer
Watch semantic infection spread silently across services — and how autonomous Bob subagents deploy in parallel to isolate, prove, and immunize each node.
The Bug Replay Tax
Developers fix symptoms in one file. Without semantic repository immunity, identical bugs resurface weeks later in other services.
82% of architectural twin bugs escape grep
Grep can only match literal tokens. When the same architectural mistake is written with different variable names, operators, or imports, traditional search finds nothing.
0% coverage for repo-specific business invariants
Off-the-shelf linters enforce generic style rules. They know nothing about your company's proprietary ORM quirks, multi-tenant boundaries, or custom billing invariant.
Unverified AI suggestions waste 4.2h / week
Generic AI code assistants guess without executing tests. They generate unverified opinions that developers must manually double-check, adding cognitive fatigue.
Deep Compiler Inspection
Compare how standard text grep sees code vs. how IBM Bob's Abstract Syntax Tree (AST) engine uncovers fatal runtime type mismatches.
renews_at - now() or utcnow() or across 2 function scopes, grep returns 0 hits.
Biological Metaphor Engineered for Code
A closed-loop autonomous system built directly on IBM Bob 2.0 primitives.
Who: IBM Bob 2.0 (Document Understanding)
Bob ingests the fix diff, commit message, and linked incident postmortems (Markdown, PDF) to extract the abstract root cause: the mistake concept, not the file location.
Output: diagnosis.json
Who: Bob Subagents + Deterministic CLI
Autonomous subagents hunt twins across the codebase by meaning. A twin is confirmed ONLY when the CLI executes a pytest that fails (red) and subsequent fix passes (green).
Output: candidates.json + verdicts/
Who: Red-Team Subagent vs Blue-Team Bob
A red-team subagent (which never sees the defense) writes realistic mutation attacks in isolated git worktrees. Bob hardens the Semgrep rule until immunity hits 100%.
Output: vaccine/round_N.json
Who: GitOps in .antibody/ directory
The hardened rule message preserves the incident context and fix link for future developers. Everything lives in git; no external database or server needed.
Output: .antibody/antibodies/
Adversarial Self-Training
How Antibody attacks itself until it reaches 100% immunity.
Most tools write a static linter rule and “pray” it works. Antibody uses adversarial game dynamics (self-play), splitting IBM Bob into two autonomous agents that compete against each other blind:
An isolated subagent that never has access to the defense rule.
Its only mission is to act like a malicious attacker or a careless developer: it invents tricky mutations of the bug to fool the system — changing operators, using aliases like utcnow(), flipping operands, or hiding the error in helper variables 15 lines later.
due_at - now()datetime.utcnow()now() > hold_untilts = now() # …+15 linesBlind to rule.yml
The agent in charge of writing the permanent protection rule in Semgrep.
It doesn't see the attacks in advance either: it must design a robust semantic pattern based purely on the root cause of the problem.
# derived from the root cause, not the attacks
- pattern: $X < datetime.now()
- pattern: datetime.now() > $X
- pattern: ($X - datetime.now()).days
- pattern: datetime.utcnow()Blind to attacks/
The result: a defense that wasn't validated by human opinions, but forged under fire against real adversarial mutations.
Anti-Hallucination Philosophy
Antibody refuses to make claims it cannot demonstrate with real compiler or pytest execution.
Looks at code and generates speculative comments: 'Line 42 might be problematic'. Requires human engineers to manually write repros and investigate false alarms.
AI Assistant: "This datetime comparison might cause issues if naive.
Consider refactoring billing/reports/monthly.py."
[!] Candidate cannot be tested. Developer wastes 35 mins verifying false positive.Never reports a twin it cannot execute. Spawns an isolated subagent that writes a test. The twin is recorded if and only if pytest returns exit code 1 (failing) then 0 (passing).
{
"candidate_id": "c01",
"verdict": "CONFIRMED_TWIN",
"red_phase": { "exit_code": 1, "failing_assertion": "TypeError" },
"green_phase": { "exit_code": 0, "status": "PASSED" },
"recorded_by": "antibody-cli"
}Powered by IBM Bob 2.0
Built as a first-class native Bob Mode using commands, skills, and subagents.
Bob reads fix diffs, GitHub issues, and architecture postmortems (PDF, Word, Markdown) to distill the exact underlying failure pattern.
Bob traverses the entire repository structure, recognizing identical design mistakes even when syntax and variable naming differ completely.
One subagent per twin candidate proves issues in complete worktree isolation without blocking developer checkouts.
Bob acts as both Red-Team attacker (writing adversarial variants) and Blue-Team defender (writing Semgrep rules), converging on 100% immunity.
Zero Infrastructure Overhead
No SaaS accounts. No third-party data transmission. No database to manage. All evidence, scores, and permanent rules are plain files checked into git and reviewed via standard Pull Requests.
.bob/ # Native IBM Bob 2.0 mode ├── custom_modes.yaml ├── commands/antibody.md └── skills/antibody-vaccine/ .antibody/ # Immutable evidence store ├── config.json # Token & round budgets ├── runs/20260926-101500/ │ ├── diagnosis.json │ ├── verdicts/c01.json │ └── scoreboard.json └── antibodies/001-naive-vs-aware/ ├── rule.yml # Hardened Semgrep rule └── history.md # Incident story for devs
Live Interactive Terminal
Click any command chip below to execute realistic workflows with authentic CLI spinners, isolated worktrees, and pytest verdicts.
Developer Experience
Get up and running in under 60 seconds inside your repository.
antibody init
Installs the custom Antibody mode into .bob/ and sets up config budgets.
/antibody a1b2c3d
Bob executes the 4 phases, pausing for your approval before touching code.
antibody scoreboard
Generates the visual report to verify immunity and review test proofs.
The Creators
Engineered with precision for the IBM Bob 2.0 Hackathon (September 2026, lablab.ai).
Equip your repository with an autonomous immune system. Built for the IBM Bob 2.0 Hackathon.
Get Started on GitHub