Swiss Startup 0sec Labs Open-Sources AI Harness for Pentesting and Code Review

The Y Combinator-backed tool runs on customers' own model providers and drives security work through a browser console, a command line or an MCP server.

By Nakoda News Desk

17 hours ago·2 min read

Prefer Nakoda News on Google

0sec Labs, a Y Combinator-backed security startup based in Switzerland, has released 0, an open-source harness that uses large language models for vulnerability research, code review, penetration testing, reverse engineering and writing fixes.

0 is not a model. It coordinates models and existing security tools. Users connect a model provider of their choice, and 0 runs scoped workflows against systems they are authorised to test. The project's GitHub page says it is licensed under MIT or Apache-2.0. Developers can run it from a local browser console that needs no account, a headless command-line tool, or a Model Context Protocol server. The MCP server lets coding agents call its workflows directly.

Security teams are trying to automate more of the slow manual work of finding and confirming bugs, and several open-source agent tools now compete for that role. MarkTechPost compared 0 with three of them: Keygraph's Shannon, Strix and Alias Robotics' CAI. In that comparison, 0 covers the widest range of targets, from web applications and source code to software packages, compiled binaries and the Linux kernel.

The architecture is built on checking findings before trusting them. A research agent plans an attack, maps endpoints and tests hypotheses. Filters then discard weak results, and a separate session tries to reproduce each remaining finding before it appears in a report. Reports can be exported in formats including HTML, PDF, SARIF and JSON. Compiled software goes to a separate engine, 0verse, which wraps the Ghidra, angr and AFL++ analysis tools.

The tool supports 14 listed model providers, including OpenAI, Anthropic, DeepSeek, Qwen, Kimi and Grok, along with the Claude, Codex and Gemini command-line runtimes. It runs on Apple Silicon Macs, on x64 or ARM64 Linux, or in a container, and needs no GPU because inference runs at the provider.

The company's benchmark claims are self-reported. MarkTechPost noted they do not reflect first-attempt success rates. According to those figures, 0 solved 93 of 95 web capture-the-flag challenges from XBOW with a GPT-5.4 cohort of models, counting a challenge as solved if any retained run succeeded. Testing only from outside the target, without source code, it solved 81 of 104 challenges, and a 2026 cold run solved 45 of 104. It scored 36 of 40 on the Cybench benchmark. The company recorded a cost of about $5.20 per solved XBOW challenge.

The company's research page lists more than 30 merged fixes for previously unknown Linux kernel vulnerabilities, along with disclosures in libraries including node-forge, protobuf.js and Wireshark. MarkTechPost described the release as a research preview.

The open-source harness is free, and users pay their model provider directly. A hosted version, 0cloud, connects to GitHub repositories and checks pull requests in a sandbox. It is on a waitlist, and its pricing page lists $100 in trial credits and $5 per pull-request security test.