We’ve been experimenting with various harness architectures for security research, and today we’re open-sourcing our latest version: 0.
Thanks to it, we’ve found 30+ Linux kernel 0-days, as well as vulnerabilities in widely used projects like Wireshark, node-forge, and jsonata. Some of our findings affect software running on billions of devices.
Despite the labs claiming that their latest model can find more vulnerabilities than everyone else, our testing shows that combining multiple LLMs from different labs tends to give better results.
Our hypothesis is that the training data + post training differences affect the “creativity” of the model and the various ways it goes about discovering edge cases.
Also there’s a ton of variance accross runs even within the same model. Especially in long-horizon style tasks (typically 4h+). There are so many variables to keep track of when benchmarking.
That’s how we’ve iterated to make 0 what it is today.
It supports parallel agents + a way for agents to communicate with each other. We’re using it for general pentesting, reverse engineering, vulnerability reproduction, and testing fixes. It works across web apps, APIs, source code, binaries, and kernels.
You can use it through the CLI or web interface, or connect it to your existing coding agent through MCP.
The goal is to make the tooling we’ve been using accessible to everyone. It’s still early, and there’s a lot we want to improve.
Would love your feedback!