0 by 0.security: Open-Source AI Pentest Harness, Reviewed

0.security, a Swiss applied-AI and cybersecurity research lab, has released 0, an open-source AI security harness. It announced the project on X as backed by Y Combinator and credited with 30+ Linux kernel 0-days. The code is on GitHub at 0sec-labs/0. This page separates what the repository and public records show from what remains the vendor's own claim, as of 9 November 2026.

What 0 is

Per the README, you install a single binary, run 0, and get a browser console with no account. You bring your own model provider. It organises findings in a queue and a board, runs workflow templates for assessment, verification, fixes and research, and keeps results and notes between runs. For automation, the CLI exposes the same workflow runner and 0 mcp-server --workflows exposes it to other agents over MCP. A hosted version, 0cloud, is on a waitlist.

For binary analysis the README describes a separate "0verse" component that needs a local Ghidra and Java installation. It adds a warning worth repeating: unavailable analysis "is not a clean scan". The project says to assess only authorised systems and offers an optional scope plugin to enforce target boundaries.

What the vendor claims, and what we could check

The vendor's own notes are candid about limits. Its July research notes include "Finding the function wasn't enough", where a binary-analysis experiment located suspicious code but produced no confirmed triggers, and "A real bug. An incorrect claim of novelty.", where its pipeline called a known driver bug new. Read these before taking any headline count at face value.

Timeline

The installer, read not run

The README tells you to pipe a script from GitHub into bash. We read the script rather than running it. It picks a binary for your OS and CPU, downloads checksums.txt and the binary from the latest release, compares SHA-256 and refuses to install on a mismatch. It also downloads a companion static analyser, FoxGuard, pinned to one version with checksums written into the script, and edits your shell profile to add itself to PATH. The checks catch corruption and a swapped file. They do not tell you whether to trust the publisher, because the checksum file comes from the same release as the binary.

What security leaders should do this week

• Check your own software against the fixes named above: node-forge before 1.4.0, jsonata before 1.8.8 and 2.2.0, and Wireshark's ciscodump in the affected 4.6 and 4.4 ranges.
• Decide who may point an AI harness at your systems, and how scope is enforced. Use the vendor's scope plugin or your own network controls, not trust in the prompt.
• If your team wants to try it, do so on a disposable VM, with a throwaway model key, against systems you own.
• Treat MCP access as a privilege: an agent that can run a pentest workflow can also run it against the wrong target.
• Verify every finding yourself. The vendor describes confirmation as a separate step with its own evidence.
• Make sure your own security.txt and disclosure route work, because automated research tools will find them. The vendor says its June survey found security.txt on about 1 in 10 sampled .ch domains.

Put it to work

• AI Pentesting Detector Lab: practise spotting an automated, AI-assisted test in your logs.
• AI Red Teaming Lab: run a red-team exercise against an AI system.
• Agentic AI Security Lab: look at the permissions and tool access that make agents risky.
• MCP Guard: review an MCP server before you connect an agent to it.
• Vulnerability Prioritizer: rank the CVEs above against your own exposure.

FAQ

What is 0 by 0.security?

An open-source AI security harness from 0.security, a Swiss research lab that says it is backed by Y Combinator. Its README describes a local browser console and CLI for investigating vulnerabilities, reviewing findings and working on fixes, with your own model provider, plus an MCP server so coding agents can run its workflows. The README labels it a research preview.

Is 0 open source and what licence does it use?

Yes. The repository says it is dual-licensed MIT OR Apache-2.0. It is on GitHub at 0sec-labs/0.

Did it really find 30+ Linux kernel 0-days?

That is the vendor's claim. Its research page lists "30+ merged 0-days in the Linux kernel" and a public list of disclosures, several marked merged upstream, others in review or queued. We checked that five of the listed CVE numbers exist in NVD. NVD descriptions do not say who found them, so the attribution to 0.security is the vendor's claim, not something we confirmed.

Did it find bugs in Wireshark, node-forge and jsonata?

The vendor lists all three on its disclosure page: Wireshark CVE-2026-15164, node-forge CVE-2026-33896 and jsonata CVE-2026-77413 and CVE-2026-52746. NVD has records for the first three of those CVE numbers; we did not look up CVE-2026-52746. The NVD text for the Wireshark entry calls it a crash and denial of service in ciscodump, while the vendor labels it a heap out-of-bounds write.

What about the 3+ billion devices and the Swiss, Italian and EU government code?

We could not source the 3+ billion figure from the vendor's research page. For government code the page lists one item, a medium-severity information leak in Swiss Federal Chancellery code (GHSA-32p4-g4fj-cg95). We found no Italian or EU government entry on the list we read. Treat both parts of the announcement as unconfirmed until the vendor publishes the records.

Is it safe to install?

The installer is a short shell script that downloads a release binary and checks it against a checksums.txt file from the same release before installing, and it also fetches a pinned companion scanner with a hard-coded checksum. A checksum from the same place as the binary shows the download was not corrupted, not that the publisher is trustworthy. Read the script, run it on a disposable machine first and give it only the targets and API keys you mean it to have.

What should a security team do about this announcement?

Check your own dependencies against the named fixes (node-forge before 1.4.0, jsonata before 1.8.8 and 2.2.0 per NVD, Wireshark ciscodump in 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16). Decide whether anyone may run an AI harness against your systems and how scope is enforced. Treat its output as leads to verify, which is how the vendor itself describes its results.

Sources

• 0sec-labs/0 on GitHub: README, LICENSE (MIT OR Apache-2.0), SECURITY.md, install.sh and package.json, read 9 Nov 2026
• 0.security research page: research notes and the public disclosure list (vendor claims)
• NVD: CVE-2026-33896 (node-forge)
• NVD: CVE-2026-77413 (jsonata)
• NVD: CVE-2026-15164 (Wireshark ciscodump)
• NVD: CVE-2026-68124 (Linux kernel mctp)
• NVD: CVE-2026-63801 (Linux kernel TIPC)

This article is educational guidance for security leaders, not legal advice. We have no commercial relationship with 0.security. We have not run the software.