0sec-labs/0 is an open-source multi-model harness that orchestrates LLM agents to find, verify, and fix vulnerabilities in software you own, exporting findings as JSON, Markdown, or SARIF.
| Tool | 0sec-labs/0 — open-source, self-evolving, multi-model harness for security research from the Swiss Applied AI & Cybersecurity Research Lab |
| Category | LLM-driven security automation / agent harness (TypeScript) aure not |
| Primary Use | Running benchmark-led agent investigations, adaptive subagent delegation, and evaluated self-improvement workflows against in-scope codebases, exporting SARIF reports |
| Safe Use | Authorized assessments, owned systems, and research pipelines only — the README itself states: only test systems you own or are authorized to assess |
| Telemetry Note | Agents use fresh-context subagents with bounded budgets, leave verification evidence for every finding, and generate exportable report artifacts defenders can audit post-run |
0, published under 0sec-labs/0 by the Swiss Applied AI & Cybersecurity Research Lab, is described in its own README as an "open-source, self-evolving, multi-model harness for security research." The framing is deliberately broader than a scanner: the project positions itself as infrastructure for LLM agents that study a codebase, find vulnerabilities in deep layers, propose fixes, report, and then improve their own strategies for the next run. The repository carries roughly 168 stars, is written primarily in TypeScript, and is explicitly labeled a research preview, which should calibrate expectations before anyone deploys it against production systems.
What makes 0 interesting architecturally is the separation between the harness itself and the models that power it. The tool follows a bring-your-own-model design: you supply API access to whichever LLMs you prefer, configure connections in the terminal after install, and the harness orchestrates deterministic steps alongside adaptive investigations. This matters for professional adoption because it keeps sensitive source code and findings inside infrastructure the operator controls, rather than routing everything through a single vendor's hosted pipeline. The README is explicit that the managed 0.security service — with model routing, non-public frontier cyber models, and a purpose-built attack runtime — is a separate commercial layer, not a requirement for running the open-source harness.
Installation is a single non-interactive pattern: curl -fsSL https://raw.githubusercontent.com/0sec-labs/0/main/install.sh | bash followed by invoking the 0 binary. After that, the operator configures model connections in the terminal and can run the harness locally or through the CLI in CI/CD pipelines. As with any piped-to-shell installer, reviewing the install.sh contents before execution is basic hygiene for a tool that will later be granted file access and model spend. There is also an agent-oriented setup path: the README suggests a prompt you paste into a coding agent pointing it at hxxps://0[.]security/harness/setup.md and llms.txt, including instructions to confirm targets and scope before testing and to ask before changing files — a scope-first default that reflects well on the project's operational discipline.
The core workflow, per the README's security-cycle diagram, is that Zero "studies, finds, fixes, reports, and improves." Concretely, this decomposes into several capabilities worth examining. First, an in-house security linter provides deterministic coverage. Second, the harness is extensible: you can connect your own tools, and the agents can write and run new tools mid-investigation, which the project identifies as a developing research workflow rather than a mature feature. Third, findings and verification results can be inspected in a console and exported as JSON, Markdown, or SARIF — the last of which makes the output directly consumable by standard CI/CD and code-scanning platforms.
The agent loop is where most of the engineering substance lives. The README describes "adaptive agents" that delegate focused investigations to subagents provisioned with fresh context and bounded budgets, then collect their findings; documentation references include the agent loop and console subagent monitoring pages. This is a recognizable pattern from modern agent architecture: a parent agent that would otherwise suffer context pollution spawns isolated workers, each attacking one hypothesis with its own token and time budget. The bounded-budget constraint is not just cost control — it is also a safety property, because a runaway investigation loop against a target is exactly the failure mode that turns an authorized scan into a self-inflicted denial of service.
The most unusual claim is the "evaluated self-improvement" plane. Agents propose changes to their own strategies or tooling, those changes are evaluated against benchmarks, and better-performing versions are selected for future runs. The project ties this to benchmark-led agent design and A/B-tested attack strategies, with public findings published for inspection. Treating offensive methodology as a versioned, A/B-testable artifact is an interesting research stance — it turns prompt and strategy engineering into a measurable discipline rather than folklore. It also means the harness you run next month may behave measurably differently from the one you ran today, which argues for pinning versions in any repeatable assessment pipeline.
The README grounds these claims in disclosed research rather than pure aspiration, pointing to public disclosures and upstream fixes, including work in the Linux kernel. For a security tool, verifiable upstream CVE disclosures are the strongest available signal that the pipeline actually finds real bugs at depth — the binary-analysis and fuzzing topics attached to the repository (binary-analysis, fuzzing, sast, cve, owasp, prompt-injection, mcp) suggest the intended coverage surface spans memory-level targets, web application logic, and the LLM-integration layer itself.
The defensive angle deserves emphasis. A harness that both finds and proposes fixes, with explicit instruction to review generated fixes before applying them, fits naturally into a DevSecOps shift-left posture: findings arrive with verification evidence attached, fixes are suggestions rather than silent patches, and SARIF export feeds existing triage workflows. The telemetry footprint for defenders and auditors is correspondingly rich — every finding is expected to carry inspectable evidence, subagent activity is visible in the console, and report artifacts persist after the run. If you are a blue team evaluating this tool, those artifacts are your audit trail for what the agents actually did.
The status section is candid about limitations: coverage and verification depth vary by workflow, tool-making and self-improvement remain developing research areas, and users are told to inspect evidence and review generated fixes before applying them. Licensing is permissive — MIT OR Apache-2.0 according to the README badges, though GitHub metadata reports the license as unasserted pending auto-detection, so verify the LICENSE files directly. Contribution and security-issue reporting are documented in CONTRIBUTING.md and SECURITY.md respectively.
The project's stated endgame, "make software secure itself," is a manifesto-level ambition: security that finds and fixes vulnerabilities as software changes, so humans can focus on building. Whether self-improving agent harnesses reach that bar is an open research question, but 0 is a concrete, inspectable artifact of the attempt. For authorized professionals — researchers with disclosed-findings obligations, AppSec engineers wiring agent-driven review into CI, or red teamers studying how LLM-driven tradecraft is being industrialized — it is a repository worth reading closely, with the standing caveat the authors themselves attach: only test systems you own or are authorized to assess.
0sec-labs/0.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.