0sec Opens Its Autonomous Security Research Tool to Find Real CVEs
A Y Combinator-backed Swiss lab open-sourced its autonomous security agent harness, which has already surfaced over 30 Linux kernel zero-days.
- Swiss lab 0sec-labs open-sourced 0, an AI harness for autonomous security investigations, backed by Y Combinator.
- Agents have filed 30+ Linux kernel zero-days plus CVEs in jsonata, Wireshark, node-forge, and protobuf.js.
- Ships a web UI, CLI, and MCP server so coding agents like Claude Code or Cursor can call its workflows.
- Bring-your-own model harness with parallel agents, sandboxed reproduction, and verified fixes before human review.
- Includes 0verse, a Ghidra-based local binary analysis stack for reverse engineering compiled targets without source.
- Dual MIT/Apache-2.0 licensed, installs via one curl command, with optional hosted 0cloud on waitlist.
Swiss AI security lab 0sec has released 0 on GitHub, an open-source harness for running autonomous security investigations against authorized code, binaries, applications, and infrastructure. The system coordinates parallel agents, security tools, sandboxed verification, and proposed fixes through a browser interface, command-line client, or Model Context Protocol server.
The release matters for developers because it packages work that teams often assemble themselves: connecting models to security tools, dividing investigations among agents, reproducing suspected vulnerabilities, preserving evidence, and integrating the results into development workflows. According to the maintainers, 0 has contributed fixes affecting AMD, Qualcomm, Cisco, Arm, Google, Meta, IBM, NVIDIA, Intel, and Red Hat. Its disclosure log also includes Linux kernel CVEs across Bluetooth, NFC, mac802154, MCTP, and mlx5e subsystems.
The documented installer supports Apple Silicon macOS and x64 or ARM64 Linux. Running 0 starts a local engine and opens a browser console without requiring a 0cloud account. Users supply their own model provider, so code and prompts may still pass through that provider under its data-handling terms.
What ships in the harness
0 provides a control plane around models and security tools, with each interface addressing a different part of the workflow.
| Component | Purpose | Typical use |
|---|---|---|
| Web UI | Displays chats, findings, evidence, and run status in queue or board views. | Interactive investigation and human review. |
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
