What is this?
0 is an open-source, self-evolving, multi-model AI harness for security research that finds, verifies, and fixes vulnerabilities, built by the Swiss Applied AI & Cybersecurity Research Lab.
0 is an open-source, self-evolving, multi-model AI harness for security research that finds, verifies, and fixes vulnerabilities, built by the Swiss Applied AI & Cybersecurity Research Lab.Is this a standalone tool, or do I need the hosted 0.security service?It is a self-contained open-source harness you can run locally or via CLI in CI/CD using your own model access; the hosted 0.security service is a separate, optional paid layer with extra model routing and tooling.
It is a self-contained open-source harness you can run locally or via CLI in CI/CD using your own model access; the hosted 0.security service is a separate, optional paid layer with extra model routing and tooling.How do I get it running?Copy the provided setup prompt into your coding agent to install the harness and read the docs, or do a quick install and bring your own model access configured in the terminal.
Copy the provided setup prompt into your coding agent to install the harness and read the docs, or do a quick install and bring your own model access configured in the terminal.Do I need my own LLM API access?Yes, you bring your own model access and configure the connections yourself; the open-source harness does not ship with a built-in model.
Yes, you bring your own model access and configure the connections yourself; the open-source harness does not ship with a built-in model.How reliable are the findings right now?This is a research preview, so coverage and verification depth vary by workflow, and you should inspect the evidence and review any generated fixes before applying them.
This is a research preview, so coverage and verification depth vary by workflow, and you should inspect the evidence and review any generated fixes before applying them.Can I point it at any target I want?No, you may only test systems you own or are explicitly authorized to assess.
No, you may only test systems you own or are explicitly authorized to assess.What is the hosted 0.security service for?It adds optimized model routing, access to non-public frontier cyber models, a purpose-built attack runtime, and a curated offensive toolchain on top of the open-source harness.
It adds optimized model routing, access to non-public frontier cyber models, a purpose-built attack runtime, and a curated offensive toolchain on top of the open-source harness.What does self-improving mean for this harness?The harness proposes changes to its own agents and tools, evaluates them against benchmarks, and keeps the better-performing versions for future runs.
The harness proposes changes to its own agents and tools, evaluates them against benchmarks, and keeps the better-performing versions for future runs.Why is it called a multiplayer offensive security OS?It delegates focused investigations to multiple subagents with fresh context and bounded budgets, then collects their findings into one workflow.
It delegates focused investigations to multiple subagents with fresh context and bounded budgets, then collects their findings into one workflow.What output formats does it produce?Findings and verification results can be exported as JSON, Markdown, or SARIF reports.
Findings and verification results can be exported as JSON, Markdown, or SARIF reports.What are similar projects?mantis, AI-Infra-Guard, strix, codex-security, shannon, cynative, Anthropic-Cybersecurity-Skills, Ai-jailbreak
mantis, AI-Infra-Guard, strix, codex-security, shannon, cynative, Anthropic-Cybersecurity-Skills, Ai-jailbreakWhich topics is it in?sast, cve, owasp, application-security, prompt-injection, fuzzing, llm-security, devsecops, binary-analysis, security-research, ai-security, vulnerability-scanner
sast, cve, owasp, application-security, prompt-injection, fuzzing, llm-security, devsecops, binary-analysis, security-research, ai-security, vulnerability-scanner