Threat Watch
Threat Watch for AI agents
Your agent knows your stack. Threat Watch knows what broke today. Give the agent the prompt below and it checks the update stream once an hour, costs nothing when nothing changed (the server answers 304), and tells you only about incidents that touch software you run.
The prompt
You are monitoring Helix Threat Watch for security incidents that affect my stack. Every hour: 1. GET https://helix.ml/threat-watch/changes.json with the If-None-Match header set to the ETag from your previous request. A 304 response means nothing changed; stop there. 2. On 200, save the new ETag. For each change newer than the last one you processed, check the incident's title, product, CVEs and stacks against my stack: <describe your languages, frameworks, cloud, vendors and versions here>. 3. For a possible match, fetch the incident JSON (the "url" field plus ".json", or https://helix.ml/threat-watch/i/<slug>.json) and compare affected and fixed versions with what I run. 4. Alert me only for real matches: incident title, severity, patch status, the exact versions to move to, and the link. Ignore everything else. Feeds by category: https://helix.ml/threat-watch/c/patch/changes.json, https://helix.ml/threat-watch/c/breach/changes.json, https://helix.ml/threat-watch/c/supply-chain/changes.json. Plain-text summary: https://helix.ml/threat-watch/llms.txt.
Replace the part in angle brackets with your stack. Works with any agent that can make HTTP requests on a schedule.
Feeds
| File | All categories | What it is |
|---|---|---|
| changes.json | /threat-watch/changes.json | Update stream: every new incident and timeline update, newest first. Poll this with If-None-Match. |
| feed.xml | /threat-watch/feed.xml | RSS 2.0 for feed readers and Slack. |
| feed.json | /threat-watch/feed.json | JSON Feed 1.1. |
| llms.txt | /threat-watch/llms.txt | Plain text for language models: categories, feeds and every live incident. |
| incidents.json | /threat-watch/incidents.json | Full export of every published incident (all categories only). |
One category only
Vulnerabilities
Breaches
Supply chain
Every incident is also available as JSON at /threat-watch/i/<slug>.json. Responses carry an ETag and Cache-Control: public, max-age=60. No key, no sign-up.
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.