Zurich-based company 0sec Labs has released 0 as open source, an AI-based cybersecurity tool. It is distributed under the MIT OR Apache-2.0 license and is presented as a research preview (research preview). It is used to conduct vulnerability investigations, review code, perform penetration testing (pentesting), carry out reverse engineering, and generate patches.
- 0sec Labs publie 0, un outil de cybersécurité open source basé sur l’IA, pour la recherche de vulnérabilités, la revue de code, le pentesting, la rétro-ingénierie et la génération de correctifs.
- 0 agit comme une couche de contrôle autour du modèle de langage choisi par l’utilisateur et ne travaille que sur des cibles autorisées.
- L’outil s’utilise via une console web locale, une interface en ligne de commande ou un serveur MCP, et génère des rapports dans plusieurs formats.
- Les scores de performance, déclarés par l’éditeur, sont élevés, l’outil est gratuit et une version hébergée payante est en liste d’attente.
According to the publisher, 0 is not an AI model but a control layer placed around large language models (LLMs) and security tools. The user connects their chosen provider, then 0 executes work processes limited to authorized targets. Developers can use it via a local web console, a command-line interface without a graphical display, or via an MCP server, a protocol for connecting programming agents.
A multi-step operation
The architecture documentation describes a central principle: reproduce before trusting. A research agent selects vulnerability classes to examine, maps access points, and tests hypotheses. Filters then discard weak results, and a separate session replays each candidate lead, with a maximum of five exchanges per finding. Reports can be generated in HTML, PDF, SARIF, Markdown, and JSON.
For compiled programs, the tool relies on 0verse, an integrated engine that encompasses Ghidra, angr, and AFL++. Its local MCP server exposes nine tools for analysis, triage, vulnerability proofs, and reporting.
Results published by the publisher
All scores communicated by 0sec Labs are self-declared. On the XBOW benchmark dedicated to web-based CTF exercises, the tool scores 93/95 (97.9%) with the gpt-5.4 cohort. On the same benchmark, the black-box union reaches 81/104 (77.9%), and a cold execution performed in 2026 shows 45/104 (43.3%). On Cybench, the announced score is 36/40 (90.0%) with Azure gpt-5.4 and three attempts. The recorded cost is approximately $5.20 per solved XBOW challenge.
According to the publisher’s research page, 0 has also contributed to more than 30 vulnerability fixes in the Linux kernel merged into the official code. The disclosures concern the Bluetooth, NFC, mac802154, TIPC, and mlx5e subsystems. CVE for libraries, including jsonata, node-forge, protobuf.js, and Wireshark, are also cited.
Availability and pricing
The open-source tool is free, and the user only pays their model provider. A hosted version, 0cloud, is accessible via a waitlist. The pricing page mentions $100 in trial credits and $5 per pull request (PR) security test.
The code is available on the project’s GitHub repository.
