0sec

A team of AI agents

A lead agent splits the work across parallel strategies and focused subagents, targeting web apps, APIs, source code, packages, and MCP servers — all inside a scope that’s checked on every tool call.

Reproduce before trusting

A separate, blind agent re-exploits each finding seeing only the PoC. Anything it can’t reproduce is dropped — never shipped as “low confidence.”

Real CVEs, not leaderboards

0sec’s research loop has disclosed real bugs in the Linux kernel and widely-used open source, with maintainer review from Intel, NVIDIA, Red Hat, Google, and more. The live track record lives at 0.security.

Binary analysis, no source

When there’s only a compiled binary, the in-repo 0verse engine runs a find → prove → patch → verify loop and confirms a bug only with a reproducing proof-of-vulnerability.

Bring your own model

Anthropic, OpenAI, Azure (EU regions), OpenRouter, DeepSeek, Z.ai GLM, Moonshot Kimi, Qwen, a ChatGPT-Codex subscription, or local Ollama — with a hard per-run cost ceiling.

Evidence you can inspect

Every run keeps its own SQLite state, an append-only journal, and artifacts under ~/.0sec/runs/ — so you can resume, replay, or disclose it later.

Start here

• Getting Started — install, define a scope, run your first scan
• Commands — the full CLI reference
• Configuration & API Keys — models, providers, and cost ceilings

How it works

• Architecture — the pipeline, runtime adapters, and MCP integration
• Agent Loop — how the agents plan, act, reflect, and stop
• Blind Verification — why findings are re-exploited before they count
• Finding Triage — the layers that cut false positives between research and verify

Proof

• Found in the wild — the running, verified CVE track record
• Benchmarks — where 0sec sits on public CTF benchmarks, with honest caveats (we treat these as secondary to real disclosures)