0sec Labs Open-Sources "0," an AI Security Harness With Web UI, CLI, and MCP Support
Zurich-based 0sec Labs has released 0, an open-source AI security harness designed to run vulnerability investigations, code review, penetration testing, reverse engineering, and automated fix generation. Developers can drive the tool through a local browser console, a headless CLI, or an MCP server.
The harness is dual-licensed under MIT OR Apache-2.0 and ships as a research preview. Its release arrives as agentic security tooling matures into a mainstream category in 2026, with platforms increasingly expected to interoperate through standards like MCP rather than lock users into proprietary interfaces.
TL;DR
- Wrapper model: It is a software harness, not a foundation model. You bring your own LLM from 14 supported providers.
- Runs on: Apple Silicon macOS, x64 or ARM64 Linux, or the
ghcr.io/0sec-labs/0container. No GPU is required—model inference happens at your chosen provider. - Performance: Strong self-reported CTF scores, plus a public record of upstream Linux kernel fixes.
- Best result: 93/95 (97.9%) on XBOW web CTFs, gpt-5.4 cohort, any-success grouping.
How It Works
Rather than bundling its own model, 0 acts as an orchestration layer: it supplies the agent scaffolding, tooling, and security-specific workflows, while the underlying reasoning comes from the LLM you configure. That separation lets teams keep control over model choice, data residency, and cost—an increasingly important consideration as enterprise security workflows adopt AI agents in 2026.
Because inference happens entirely at the provider, 0 runs on commodity hardware: Apple Silicon macOS, x64 or ARM64 Linux, or as a container image. No local GPU is needed.
Flexible Interfaces
The harness offers three ways to operate, matching different developer workflows:
- Local browser console — an interactive Web UI for exploratory security work.
- Headless CLI — suited to scripting, CI/CD pipelines, and automated runs.
- MCP server — integration with the growing ecosystem of MCP-compatible clients and agent frameworks, letting 0 act as a security tool within broader agentic workflows.
Benchmarks and Real-World Results
0sec Labs reports strong results on XBOW web CTF tasks, peaking at 93/95 (97.9%) with the gpt-5.4 cohort using any-success grouping. The company also maintains a public record of upstream Linux kernel fixes generated with the harness—evidence, it says, of real-world utility beyond synthetic benchmarks.
As with all self-reported security benchmarks, independent verification remains valuable. Automated vulnerability discovery tools have become increasingly credible in 2026, but accuracy, false-positive rates, and reproducibility still matter when evaluating production use.
What's Next
For teams building AI-assisted security programs, 0 offers a model-agnostic, open-licensed option that keeps inference under the user's control. The project's availability as a research preview signals that it is still maturing, so organizations should evaluate it against their own test suites before deploying it in critical security workflows.
via MarkTechPost