We saturated the benchmark
103 of 104 on XBOW, every solve backed by an auditable receipt. The benchmarks ran out of headroom, so we turned the engine on real software.
AI hackers
for enterprise.
We're a Swiss applied research lab, rebuilding cybersecurity for the AI era.
Built to protect global enterprises, military & defence.
Where failure is not an option.
LIVE FINDINGS
import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none)
import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none)
import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none) import { verify } from "crypto" const token = req.headers.authorization if (!assertAccess(org)) return exec(`curl ${userInput}`) eval(serialize(body)) db.query(`SELECT * WHERE id=${id}`) fs.readFile(path.join(base, userPath)) child_process.spawn(cmd, {shell: true}) new Function(untrusted)() res.send(template(userHtml)) jwt.verify(tok, none)
paperclip·GHSA-47wq-cj9q-wpmpcriticaljsPDF·CVE-2026-31938criticaljsPDF·CVE-2026-31898highnode-forge·CVE-2026-33896highprotobuf.js·CVE-2026-44289highyaml·CVE-2026-33532mediummysql2highLiquidJS·CVE-2026-30952highjsonata·CVE-2026-52746highUptime Kuma·CVE-2026-33130mediumLinux · Bluetooth·mergedhighLinux · NFC LLCP·reportedhighLinux · NFC digital·reportedhighLinux · mac802154·reportedmediumpaperclip·GHSA-47wq-cj9q-wpmpcriticaljsPDF·CVE-2026-31938criticaljsPDF·CVE-2026-31898highnode-forge·CVE-2026-33896highprotobuf.js·CVE-2026-44289highyaml·CVE-2026-33532mediummysql2highLiquidJS·CVE-2026-30952highjsonata·CVE-2026-52746highUptime Kuma·CVE-2026-33130mediumLinux · Bluetooth·mergedhighLinux · NFC LLCP·reportedhighLinux · NFC digital·reportedhighLinux · mac802154·reportedmediumpaperclip·GHSA-47wq-cj9q-wpmpcriticaljsPDF·CVE-2026-31938criticaljsPDF·CVE-2026-31898highnode-forge·CVE-2026-33896highprotobuf.js·CVE-2026-44289highyaml·CVE-2026-33532mediummysql2highLiquidJS·CVE-2026-30952highjsonata·CVE-2026-52746highUptime Kuma·CVE-2026-33130mediumLinux · Bluetooth·mergedhighLinux · NFC LLCP·reportedhighLinux · NFC digital·reportedhighLinux · mac802154·reportedmediumpaperclip·GHSA-47wq-cj9q-wpmpcriticaljsPDF·CVE-2026-31938criticaljsPDF·CVE-2026-31898highnode-forge·CVE-2026-33896highprotobuf.js·CVE-2026-44289highyaml·CVE-2026-33532mediummysql2highLiquidJS·CVE-2026-30952highjsonata·CVE-2026-52746highUptime Kuma·CVE-2026-33130mediumLinux · Bluetooth·mergedhighLinux · NFC LLCP·reportedhighLinux · NFC digital·reportedhighLinux · mac802154·reportedmedium
Let our army of AI agents hack your software, and secure it.
How we protect 3,403,426,843 installations.
End-to-end. On any software, black-box or white-box.
We break your software,
not your trust.
You set the rules
Every scan runs in an isolated sandbox, fenced to a scope you set — allowed hosts, rate limits, a kill switch. It can’t wander off-target.
Secrets stay sealed
Exploit proof exposes real secrets — we redact them and encrypt the rest per-org, opened only by you and logged on every access.
Your data stays yours
Strict per-org isolation. Your targets and findings never touch another customer — and never train someone else’s model.