[RESEARCH PREVIEW] Your open & extensible AI cybersecurity team.
0sec finds vulnerabilities, creates working exploits, and writes the fix. Multi-model, multi-agent, but most importantly: yours.

🇨🇭 Maintained by the Swiss Applied AI & Cybersecurity Research Lab · 0.security

Note: This project is currently in active development; features change daily! See Current limitations.

Install & Quick Start

curl -fsSL https://raw.githubusercontent.com/0sec-labs/0sec/main/install.sh | bash
export PATH="$HOME/.0sec/bin:$PATH"
0 --help

The verified binary is installed to ~/.0sec/bin with no Node/Bun dependency. Add the export line to your shell profile to make 0 available in future shells.

What 0sec aims to cover

Most AI pentesting harnesses and tools stop at the web app layer to find and chain vulnerabilities. However research suggests that supply chain and other infrastructure level exploits are more common, and cheaper to exploit than ever before.

0sec's core philosophy is to be a single, extensible and transparent tool to tackle all the remaining layers as security changes from point-in-time tests towards continuous security.

Layer Finds
Web apps SQLi, IDOR, XSS, SSRF, auth bypass
APIs tenant isolation, BOLA, business-logic abuse
AI & LLMs prompt injection, jailbreaks, MCP tool abuse
Source code injection, auth, deserialization, memory safety
Dependencies supply chain, malicious packages, CVE replay
Network / identity AD, cloud, federation (read-only, offline)
Runtime / OS / kernel container escape, privesc, 0-day hunt
Compiled binaries no source → 0verse

Automation and research adapters

Task Commands
Pentest web / AI-LLM / MCP scan, eval, agent-assure
Review source / packages / kernel review, file-review, audit
Recon an attack surface recon, js-recon, npm-discovery, intel
Hunt a bug class / kernel variants hunt, kernel, cve
Work with evidence findings, history, resume, replay, verify, disclose
Generate & re-test a fix fix
Identity / AD (read-only) identity, adgraph, entragraph
Integrate mcp-server, console, tui, dashboard

Run 0 --help for the rest. Full docs: docs.0.security.

Primary workflow

Run 0 to open the primary OpenTUI chat. Type /run to open its engagement control pane, then enter a URL, a local source path, a git URL, or an explicit package target (npm:, pypi:, cargo:, oci:). The pane shows the resolved engagement before it runs it; deep source engagements use the validated finder-lens strategy. Specialized CLI commands remain available for automation and research, but they are not separate primary TUI modes.

0sec console command palette
The interactive console — / opens the command palette.

How it works

It proves the bug before it reports it.

  • Free-form agents, hard guardrails. Models decide what to probe; turn budgets, loop detection, and scope-on-every-call keep them in line.
  • Reproduce before trust. A blind agent re-exploits each finding from the PoC alone. What it can't reproduce is dropped.
  • Triage before verify. Class oracles and a second scanner cut noise before the expensive step.
  • Bring your own model. Anthropic, OpenAI, Azure, OpenRouter, or local Ollama — you hold the key.

Every run keeps its own evidence under ~/.0sec/runs/<id>/, so you can resume, replay, or disclose it later.

0sec blind verification
Blind verification — every finding is re-exploited before it ships.

Track record

0sec has landed real, maintainer-reviewed fixes in the mainline Linux kernel and other open source. The verified list lives at 0.security. Benchmarks are secondary evidence — caveats in the benchmark docs.

Supported by

With special thanks to the startup and research programs supporting our work:

AWS Startups        Microsoft for Startups        E2B for Startups        Hack Nation        NVIDIA Inception Program

Honest limitations

  • Kernel/IOKit findings stay hypotheses until a real oracle reproduces them (the linux-kernel profile is static).
  • Verification depth varies: verificationSpec covers file/diff predicates. The replay runner isolates PoCs in fresh, unprivileged, read-only Docker containers (no network by default; scoped HTTP opts into a bridge/custom network via verify --docker-network + --scope) and offline QEMU initramfs guests (--qemu-kernel / --qemu-busybox, or 0SEC_REPLAY_QEMU_*) — but a finding still has to ship executable pocSteps for any of it to run; without them the finding is skipped.
  • The false-positive-moat layers are off by default and slice-dependent.
  • Benchmarks are single-model/config/trial; the 10/10 AI-suite is self-authored, not independent.
  • fix is narrow: source-only, single-file, ≤3 attempts.
  • By design, never: network sweeps, credential spraying, persistence/C2, or stealth.

Build from source

git clone https://github.com/0sec-labs/0sec.git && cd 0sec
corepack enable && pnpm install --frozen-lockfile && pnpm build && node packages/cli/dist/index.js --help