Tag
Open-Kritt is an open-source security research platform that orchestrates multiple AI agents to analyze code in parallel, automating discovery of real vulnerabilities, and supports deduplication, validation, and prioritization. The team behind it has used it to earn significant bounties and win the Firedancer audit contest.
A tweet highlights DepthFirst Labs' new cybersecurity model dfs-large1, which matches frontier-model performance on vulnerability discovery, built on the open GLM-5.2 model with RL post-training on Fireworks AI, arguing that open weights are a defender's advantage.
Cisco president Jeetu Patel discusses the importance of open-source AI for building models to find vulnerabilities faster, and shares insights on AI inference trends and cost optimization.
Vercel releases DeepsecBench, a benchmark for evaluating AI models' ability to find cybersecurity vulnerabilities in application code, with findings that open-weight models are becoming more cost-effective for security scanning.
AI is transforming open source security by enabling faster vulnerability detection while also introducing new risks through 'vibe coding' that can reintroduce insecure code; Linux Foundation's Hilary Carter discusses this duality.
Google DeepMind's 3.5 Flash Cyber model enables defense specialists to check more code paths and detect complex vulnerabilities missed by standard models, as tested on Google Chrome and Android codebases.
Cisco released Antares, a family of small language models (350M-3B parameters) for detecting cybersecurity vulnerabilities, challenging the narrative that only large closed models can do so.
OpenAI's GPT-5.6 Sol achieves state-of-the-art on a cybersecurity benchmark, and the new Codex Security plugin helps teams find, validate, and fix vulnerabilities in real code. This article provides a step-by-step guide to installing and using the plugin in Codex.
Google introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model fine-tuned for automated vulnerability discovery and patching, offering cost-efficient performance competitive with larger models.
Mantis Skills is a portable toolkit from Google for building security review harnesses using coding agents, enabling automated vulnerability detection, reproduction, and patching across various codebases.
A new product called CYPHES enables users to monetize their OpenClaw hardware and agents by creating an autonomous labor market focused on cybersecurity vulnerability detection and exploit alerting.
A security researcher tested four AI approaches (Semgrep, GLM 5.1+Strix, Cursor+GPT 5.5, local AI with custom harness) to find a known LFI vulnerability in PHPIPAM. Only the local AI harness consistently succeeded, demonstrating that the harness methodology matters more than the model, and highlighting advantages of local AI for cost, privacy, and flexibility in security research.
Devin Cloud launches Security Swarm, using Agentic MapReduce to find security vulnerabilities in codebases, with remediation and fleet management in the Desktop app.
AutoCVE is an open-source tool that uses multi-agent collaboration to automatically complete the entire process from project screening, code audit, vulnerability verification to generating CVE reports, supporting one-click CVE vulnerability mining.
According to a WSJ report, Zhipu AI's GLM-5.2 can match top US models in vulnerability discovery scenarios; 360 Security's new tool Tulongfeng is also comparable to Anthropic's Mythos.
An open-weight model, GLM 5.2 from Zhipu AI, beats Claude Code in IDOR detection benchmarks at a fraction of the cost, though it still trails Semgrep's purpose-built multimodal pipeline. The article explores how much of vulnerability-detection performance comes from the model versus the harness around it.
Codex Security has scanned 30,000 code repositories, over 30 million commits, and fixed over 500,000 vulnerabilities in three months, demonstrating the efficiency of AI automation.
OpenAI launches Daybreak expansion plan, aiming to automate vulnerability fixes with AI, addressing the current bottleneck in security where vulnerabilities are found but no one fixes them.
Anthropic has released an open-source reference implementation for autonomous vulnerability discovery and remediation using Claude, featuring a full pipeline (recon → find → verify → report → patch) with sandboxing support. It accompanies Claude Security, a hosted product for managing vulnerabilities across codebases.
Anthropic released an open-source code auditing reference harness for autonomous vulnerability discovery and remediation using Claude, covering a recon→find→triage→report→patch pipeline, primarily targeting C/C++ memory vulnerabilities. It is a template/reference implementation rather than a production-ready product, with a managed hosted option called Claude Security also available.