# 0sec Research

> Public technical notes and public disclosure records from 0sec, a Swiss applied cybersecurity research lab.

The HTML research index is the canonical public page: https://0.security/research/

## Research notes

- [Fixing the Linux Kernel: Upstream Memory-Safety Contributions](https://0.security/blog/fixing-the-linux-kernel/): The same automated research pipeline that audits npm packages now reads kernel C and has landed 0sec-authored fixes in the mainline Linux kernel, each maintainer-reviewed and flowing into stable where applicable. Here's what merged, and how. [Markdown](https://0.security/blog/fixing-the-linux-kernel.md)
- [Does It Discover, or Does It Recall?](https://0.security/blog/does-it-discover-or-recall/): The question that separates a real automated bug-finder from a demo. We ran the airtight version, bugs fixed after the model's training cutoff, stripped, no hints, and the honest 0/4 result maps the actual frontier of automated discovery better than any win would have. [Markdown](https://0.security/blog/does-it-discover-or-recall.md)
- [Finding the Bug Is the Easy Part. Knowing It's New Is the Hard Part.](https://0.security/blog/finding-the-bug-is-the-easy-part/): Our engine confirmed a real kernel-privilege primitive in a stripped, closed-source Windows driver. Machine-verified, no symbols. It called the bug novel. It was a CVE from 2024. Here is the failure mode that hides in every automated bug-finder, and the gate we built so it can't happen again. [Markdown](https://0.security/blog/finding-the-bug-is-the-easy-part.md)
- [The Drivers Nobody Fuzzed](https://0.security/blog/the-drivers-nobody-fuzzed/): The signed Windows drivers that hand attackers kernel access are closed-source: no symbols, no source, invisible to every source-based fuzzer. We built a machine that locates the dangerous IOCTL in a stripped .sys and confirms the primitive on a live kernel, no human in the loop. Here is how, and the discipline that keeps it honest. [Markdown](https://0.security/blog/the-drivers-nobody-fuzzed.md)
- [The Bug With No Source, No Symbols, No Debug Info](https://0.security/blog/the-bug-with-no-source/): Strip a binary of source, symbols, and DWARF and it is supposed to be opaque to automated analysis. We stripped an OSS-Fuzz target of all three and our engine still found the bug. A stripped binary is an information problem, not an impossibility. [Markdown](https://0.security/blog/the-bug-with-no-source.md)
- [When the Sanitizer Is the Wrong Oracle](https://0.security/blog/when-the-sanitizer-is-the-wrong-oracle/): Two recently-patched Linux kernel use-after-frees. Trivially reachable from an unprivileged process, they fire on demand and produce zero KASAN reports by construction. A study in the two most misread words in exploitation: 'reachable' and 'confirmed'. [Markdown](https://0.security/blog/when-the-sanitizer-is-the-wrong-oracle.md)
- [AI Agents Are Entering the Kernel](https://0.security/blog/ai-agents-are-entering-the-kernel/): The real benchmark for AI security research is whether a finding survives maintainer review, lands upstream, and gets carried into the software people actually run. The public record is starting to show ours does. [Markdown](https://0.security/blog/ai-agents-are-entering-the-kernel.md)
- [Your validator checked one value. Your app used another.](https://0.security/blog/validation-read-stability/): A validation soundness bug class in JavaScript. Some widely-used validators inspect the caller's live object and hand it back unchanged, so a getter or Proxy can slip a value past the schema that the app then uses. We confirmed it in class-validator and superstruct. joi and zod are safe, and the reason they are safe is the fix. Reported upstream. [Markdown](https://0.security/blog/validation-read-stability.md)
- [One Research Loop, Evidence Matched to the Target](https://0.security/blog/one-research-loop-evidence-matched-to-the-target/): Why vulnerability research needs target-specific harnesses and oracles, but one shared discipline for evidence, novelty, and impact. [Markdown](https://0.security/blog/one-research-loop-evidence-matched-to-the-target.md)
- [A 15-Year-Old Out-of-Bounds Read in the Linux Kernel's NFC Stack](https://0.security/blog/nfc-llcp-15-year-kernel-bug/): An unauthenticated NFC peer could crash the kernel with one malformed frame. The bug shipped in 2011 and sat in every kernel since. Automated source analysis surfaced it. The fix is accepted upstream in the NFC maintainer tree and heading to mainline (ed85d4cbbfaa). [Markdown](https://0.security/blog/nfc-llcp-15-year-kernel-bug.md)
- [The Bugs Fuzzers Can't See](https://0.security/blog/the-bugs-fuzzers-cant-see/): Automated kernel bug-finding has converged on one technique: fuzzing. It has a ceiling built in. We do it differently. We read the source and reason about it, to find the bug classes a fuzzer is structurally blind to. [Markdown](https://0.security/blog/the-bugs-fuzzers-cant-see.md)
- [Switzerland Has No Doorbell](https://0.security/blog/swiss-securitytxt-survey/): Nine in ten Swiss websites publish no security.txt, so a researcher has no way to report a vulnerability. We checked every .ch domain in two public lists. Here is the data, and the ten-minute fix. [Markdown](https://0.security/blog/swiss-securitytxt-survey.md)
- [The Triage Moat and Multi-Benchmark Validation](https://0.security/blog/triage-moat-and-multi-benchmark-validation/): Ablation testing as scientific method: an 11-layer false-positive triage stack, the one broken layer that almost masked the rest, and the multi-benchmark portfolio that surfaces what a single suite would miss. [Markdown](https://0.security/blog/triage-moat-and-multi-benchmark-validation.md)
- [Web Vulnerability Benchmarks: Methodology and Environment Verification](https://0.security/blog/xbow-benchmark-methodology-and-verification/): Over 37% of standard web vulnerability challenges fail to build on clean systems because Docker images and package repos rot. Read the benchmark score without knowing the substrate and you cannot compare it to anything. [Markdown](https://0.security/blog/xbow-benchmark-methodology-and-verification.md)
- [Agentic Pentesting: The Shell-First Architecture](https://0.security/blog/agentic-pentesting-on-xbow/): Shell-first design as a discovered architecture for autonomous pentesting agents. One bash tool outperforms a structured toolkit across public benchmarks, the AI/LLM security suite, and adjacent domains. [Markdown](https://0.security/blog/agentic-pentesting-on-xbow.md)
- [Orchestration, Not Frontier: What the IronCurtain Post Means for 0sec](https://0.security/blog/2026-05-07-orchestration-not-frontier/): Niels Provos shipped a vulnerability-discovery framework that replicates Mythos-class findings on commercial models, plus one autonomous CVE on an open-weight model. It is the same bet 0sec is built on. Here is what we already do, what we need to borrow, and the four gaps we are closing. [Markdown](https://0.security/blog/2026-05-07-orchestration-not-frontier.md)
- [Deleting better-sqlite3, and What It Cost](https://0.security/blog/2026-04-07-deleting-better-sqlite3/): An engineering note from building 0sec's engine. We migrated the persistence layer from better-sqlite3 to a pure-WASM SQLite build. What broke, what we kept, and why dropping the native module made the engine run identically on every Node.js version. [Markdown](https://0.security/blog/2026-04-07-deleting-better-sqlite3.md)
- [Introducing 0cloud](https://0.security/blog/2026-04-06-the-marketing-rewrite/): An autonomous AI attacker on contract, pointed at your product. Closed beta, by application only. Founder-led from Zürich. [Markdown](https://0.security/blog/2026-04-06-the-marketing-rewrite.md)
- [The Attack Surface Traditional Benchmarks Don't Test](https://0.security/blog/attack-surface-xbow-doesnt-test/): Traditional web vulnerability benchmarks miss the entire AI/LLM security attack surface. Prompt injection, jailbreaks, MCP tool abuse: none of it appears in standard 104-challenge web security suites. [Markdown](https://0.security/blog/attack-surface-xbow-doesnt-test.md)
- [Blind Verification: How False Positives Get Killed](https://0.security/blog/blind-verification/): Every security scanner drowns its users in false positives. Closing that gap took three architectural attempts before one of them worked. [Markdown](https://0.security/blog/blind-verification.md)
- [How AI Agents Found Vulnerabilities in Popular npm Packages](https://0.security/blog/how-ai-agents-found-7-cves/): A three-week methodology validation. Claude Opus, applied systematically to popular npm packages, surfaced 73 findings and disclosed vulnerabilities across packages with 55M+ weekly downloads. Here is how the workflow operates. [Markdown](https://0.security/blog/how-ai-agents-found-7-cves.md)
- [The Age of Agentic Security](https://0.security/blog/the-age-of-agentic-security/): If AI agents can write 1,000 pull requests a week, AI agents should be testing 1,000 pull requests a week. The asymmetry is about to collapse. [Markdown](https://0.security/blog/the-age-of-agentic-security.md)

## Security reporting

- [Security contact](https://0.security/.well-known/security.txt): use this for vulnerability reports.