[RESEARCH PREVIEW] Your open & extensible AI cybersecurity team.
0sec finds vulnerabilities, creates working exploits, and writes the fix. Multi-model, multi-agent, but most importantly: yours.

_{🇨🇭 Maintained by the Swiss Applied AI & Cybersecurity Research Lab · 0.security}

_{Note: This project is currently in active development; features change daily! See Current limitations.}

Install & Quick Start

curl -fsSL https://raw.githubusercontent.com/0sec-labs/0sec/main/install.sh | bash
export PATH="$HOME/.0sec/bin:$PATH"
0 --help

The verified binary is installed to ~/.0sec/bin with no Node/Bun dependency. Add the export line to your shell profile to make 0 available in future shells.

What 0sec aims to cover

Most AI pentesting tools stop at the web app. The layers underneath it, dependencies and runtime and kernel, need different tooling to reach, so they usually go untested.

0sec is one extensible tool for all of them.

Layer	Finds
Web apps	SQLi, IDOR, XSS, SSRF, auth bypass
APIs	tenant isolation, BOLA, business-logic abuse
AI & LLMs	prompt injection, jailbreaks, MCP tool abuse
Source code	injection, auth, deserialization, memory safety
Dependencies	supply chain, malicious packages, CVE replay
Network / identity	AD, cloud, federation (read-only, offline)
Runtime / OS / kernel	container escape, privesc, 0-day hunt
Compiled binaries	no source → 0verse

Automation and research adapters

Task	Commands
Pentest web / AI-LLM / MCP	scan, eval, agent-assure
Review source / packages / kernel	review, file-review, audit
Recon an attack surface	recon, js-recon, npm-discovery, intel
Hunt a bug class / kernel variants	hunt, kernel, cve
Work with evidence	findings, history, resume, replay, verify, disclose
Generate & re-test a fix	fix
Identity / AD (read-only)	identity, adgraph, entragraph
Integrate	mcp-server, console, tui, dashboard

Run 0 --help for the rest. Full docs: docs.0.security.

Primary workflow

Run 0 to open the primary OpenTUI chat. Type /run to open its engagement control pane, then enter a URL, a local source path, a git URL, or an explicit package target (npm:, pypi:, cargo:, oci:). The pane shows the resolved engagement before it runs it; deep source engagements use the validated finder-lens strategy. Specialized CLI commands remain available for automation and research, but they are not separate primary TUI modes.

_{The interactive console. / opens the command palette.}

How it works

• Free-form agents, hard guardrails. Models decide what to probe. Turn budgets, loop detection and a scope check on every call keep them inside the engagement.
• Blind re-exploitation. A second agent gets the PoC and nothing else. If it can't reproduce the finding, the finding is dropped.
• Cheap checks first. Class oracles and a second scanner cut the noise, so the expensive step runs on less.
• Your own model. Anthropic, OpenAI, Azure, OpenRouter or local Ollama. You hold the key.

Every run keeps its own evidence under ~/.0sec/runs/<id>/, so you can resume, replay, or disclose it later.

_{Blind verification. Every finding is re-exploited by an agent that never saw the original run.}

Track record

0sec has landed real, maintainer-reviewed fixes in the mainline Linux kernel and other open source. The verified list lives at 0.security. Benchmarks are secondary evidence; caveats in the benchmark docs.

Supported by

With special thanks to the startup and research programs supporting our work:

                           

Honest limitations

• Kernel/IOKit findings stay hypotheses until a real oracle reproduces them (the linux-kernel profile is static).
• Verification depth varies: verificationSpec covers file/diff predicates. The replay runner isolates PoCs in fresh, unprivileged, read-only Docker containers (no network by default; scoped HTTP opts into a bridge/custom network via verify --docker-network + --scope) and offline QEMU initramfs guests (--qemu-kernel / --qemu-busybox, or 0SEC_REPLAY_QEMU_*). A finding still has to ship executable pocSteps for any of it to run; without them the finding is skipped.
• The false-positive-moat layers are off by default and slice-dependent.
• Benchmarks are single-model/config/trial; the 10/10 AI-suite is self-authored, not independent.
• fix is narrow: source-only, single-file, ≤3 attempts.
• By design, never: network sweeps, credential spraying, persistence/C2, or stealth.

Build from source

git clone https://github.com/0sec-labs/0sec.git && cd 0sec
corepack enable && pnpm install --frozen-lockfile && pnpm build && node packages/cli/dist/index.js --help

Desktop development

The Electron shell opens a chat-first React operator workspace against a local Bun sidecar. Operations, runs, and findings are secondary routes; Node and provider credentials never enter the renderer.

pnpm build
pnpm desktop

Package a host-native app only after compiling its matching sidecar:

# Apple Silicon macOS
bash scripts/bun-compile.sh "" dist-bin/0sec-darwin-arm64

# Linux x64
# bash scripts/bun-compile.sh "" dist-bin/0sec-linux-x64

pnpm desktop:package

The macOS desktop workflow targets a protected Apple-silicon self-hosted runner; it packages the app and smokes its bundled sidecar. A logged-in Mac desktop session remains required for visual UI verification.

For an interactive remote development session, the unpackaged app can expose a loopback-only Chromium debugger for an SSH tunnel:

OSEC_DESKTOP_DEBUG_PORT=9222 pnpm desktop

Do not expose that port on a LAN or enable it for packaged releases.

Contributing & security

See CONTRIBUTING.md: synthetic or authorized targets only. Report vulnerabilities privately via SECURITY.md (security@0sec.ai), not public issues.

License

Dual-licensed MIT OR Apache-2.0. See LICENSE / LICENSE-MIT. © 2026 0sec Labs.