0sec Labs Open-Sources 0, an AI Security Harness With Web UI, CLI and MCP

Zurich-based 0sec Labs has released 0, an open-source AI security harness. It runs vulnerability investigations, code review, pentesting, reverse engineering and fix generation. Developers drive it from a local browser console, a headless CLI or an MCP server. The 0sec Labs open-source AI security harness is licensed MIT OR Apache-2.0 and ships as a research preview.

TL;DR

• Wrapper: It is a software harness. Bring your own LLM from 14 listed providers.
• Runs on: Apple Silicon macOS, x64 or ARM64 Linux, or the ghcr.io/0sec-labs/0 container. No GPU needed. Model inference runs at your provider.
• Performance: Strong self-reported CTF scores, plus a public record of upstream Linux kernel fixes.
• Best: 93/95 (97.9%) on XBOW web CTFs, gpt-5.4 cohort, any-success grouping.
• Worst: Black-box-only XBOW union of 81/104 (77.9%). A 2026 cold run scored 45/104 (43.3%).
• Bottom line: Best: one harness spans web, source, packages, binaries and kernels. Worst: headline scores are self-reported and not pass@1.

What is 0 from 0sec Labs?

0 is a control plane around LLMs and security tools. It is not a model. You plug in a provider, and 0 runs scoped workflows against authorized targets.

The research team describes it as a self-evolving, multi-model harness. 0sec Labs is backed by Y Combinator.

How does the 0 harness work?

The architecture docs state one rule: reproduce before trusting. Agentic scans follow a conceptual pipeline:

• Plan, Discover, Attack: a research agent picks vulnerability classes, maps endpoints and tests hypotheses.
• Triage: filters remove weak findings and check evidence completeness.
• Verify: a separate session re-exercises each candidate, with 5 turns per finding.
• Report: outputs include HTML, PDF, SARIF, Markdown and JSON.

Web pentesting is shell-first. The agent uses bash with curl, python3 and sqlmap, not a fixed HTTP tool set. Evidence carries a proof grade from candidate to impact-proven.

Compiled targets go through 0verse, a separate in-repo engine. It wraps Ghidra, angr and AFL++. Its local MCP server exposes 9 tools for scanning, triage, PoVs and reports.

How do developers use it?

Installation is one script. Running 0 opens the local browser console without an account. The console has chat, a findings queue and board, workflow templates, skills and memory.

Coding agents connect through 0 mcp-server --workflows. The CLI exposes the same workflow runner with commands like 0 workflow run and 0 runs list.

Model access is bring-your-own. The API keys page lists OpenAI, Anthropic, DeepSeek, OpenRouter, Azure, Qwen, Kimi, GLM and Grok. It also supports Claude, Codex and Gemini CLI runtimes.

Benchmarks: what do the numbers say?

All scores below are self-reported.

The recorded cost was about $5.20 per solved XBOW challenge.