0sec Labs Releases Open-Source AI Security Harness
The MIT OR Apache-2.0 licensed harness automates vulnerability investigation, code review, pentesting and fix generation through a local console, CLI or MCP server.
Updated on Nov. 9, 2026 in Artificial Intelligence
Zurich-based 0sec Labs released 0, an open-source AI security harness licensed under MIT OR Apache-2.0 as a research preview. The tool supports 14 listed LLM providers and runs without a GPU, with model inference handled by the provider the user selects.
Why it matters
The release places an open-source, self-hostable framework for automated security work in the hands of developers and researchers rather than behind a proprietary service. Its published benchmark results offer a measurable reference point for how far agentic AI has advanced on offensive security tasks.
Self-reported XBOW results show a best web CTF score of 93/95 (97.9%) and a black-box-only union score of 81/104 (77.9%), with a 2026 cold run scoring 45/104 (43.3%). Independent verification of these figures has not been published.
The players
0sec Labs
A Zurich-based company that develops AI-driven security tooling and released the 0 harness as open source.
The details
0 runs an agentic pipeline of Plan, Discover, Attack, Triage, Verify and Report stages, with a separate verification session re-exercising each candidate finding over 5 turns. Developers operate the harness through a local browser console, a headless CLI, or an MCP server, and it runs on Apple Silicon macOS, x64 or ARM64 Linux, or a ghcr.io container.
Timeline
• November 8, 2026: 0sec Labs released 0 and MarkTechPost published coverage of the release.
The Tech Race
The 0 release reports results on the XBOW web capture-the-flag benchmark, where its best self-reported score of 93/95 (97.9%) extends the line of automated offensive security agents measured against that suite. It positions an open, self-hostable alternative against hosted commercial security tools competing for the same class of tasks.
Developers and security teams can run the harness locally on supported Apple Silicon macOS or Linux systems without a GPU, choosing their own model provider. Hosted pricing listed on the vendor page includes $100 in trial credits and a $5 price per PR security test.
The takeaway
Teams evaluating AI security tooling can test an open-source harness against their own environments before relying on any vendor's self-reported benchmark figures. Running independent evaluations is the most reliable way to judge how a tool performs on real targets.
Further reading
For broader context on automated tools in this space, see Artificial Intelligence coverage.
Source note: This article includes information reported by MarkTechPost.
