apologies for the absence on here the past few weeks. i’ve been heads down on development and our client load instead of social media, but i’ll get back to posting more frequent updates. you can join the discord for direct contact with me and the team, link in the replies.
as some of you know, we’ve been privately auditing smart contracts for customers and for bounties over the past 3 months. i’ve spent over a month and thousands of dollars getting this software ready to release to the public. our smart contract auditor will work the same way as vector, our pentesting engine. self serve, no human intervention, priced per sloc. when it’s in my own hands i’m confident this is one of the most capable auditing models on the market, but full autonomy is the hardest part. it’s why auditing companies require sales calls and contact before any agreement, and it’s why audits are so slow and expensive. changing this workflow is the whole point of what we’re building at zauth.
right now i’m testing vector by feeding it historical hacks. we’re blind testing it against every major smart contract exploit that’s ever happened. if it wouldn’t have caught the vulnerability in an audit, our tooling isn’t good enough yet. we rewind the chain to the block right before each exploit and hand it the source that was deployed at that moment, with no answer key and no hints. it has to locate the bug and construct the drain under the same conditions the original attacker faced. identifying the type of bug is close to solved. the hard part is proving you can actually drain it. that means chaining the contracts together the right way, blind, on a real fork, and doing it reliably on large codebases. that’s where most of my effort is going.
we plan to release in two stages. evm first, currently covering ethereum, bsc, base, arbitrum, polygon, robinhood chain and more. solana will follow, since it has a completely different runtime and a different exploit model.
reinventing how security gets done is no small task, but if you look at what zauth has delivered over the past 10 months you’ll see why i quit my job and went full time on zauth. i am betting everything on us winning.
will retweeted
When pentesting with zauth, you have two options.
a) 50 dollars for a black box test. Our agents attack your web app with nothing but the URL.
b) 150 dollars for a full source code audit.
Nobody does a real pentest for 50-150 dollars. We make cybersecurity accessible.
Our first ever GitHub advisory is live, in DragonflyDB.
One flag, with one call site. deep_integrity was set for RESTORE and nothing else, so replication and RDB file load ran the same deserializer with validation off. Malformed listpack loads clean, HGETALL segfaults the server, or leaks adjacent heap (if you shape it like that), 19/30 runs, live pointers.
Found autonomously by Project Apex. Disclosed Sep 1, fix merged Sep 17, published today by DragonflyDB team.
github.com/dragonflydb/drago…
will retweeted
Large incumbent companies are incredibly slow at handling cybersecurity related disclosures.
Reports are important, but they are irrelevant when teams take days, weeks, or months to respond.
Take personal opsec seriously, because companies often don't.
Cyber is having a moment
Across 21 major software companies, including Apple, AWS, Microsoft, and Google:
- Reported critical vulnerabilities never cleared 100 per month in four years
- Since spring they've jumped to over 600 per month
Charts of the Week: a16z.news/p/chart-of-the-wee…
been a busy weekend leading into an even busier week.
we've now disclosed four critical vulnerabilities under Project Apex, all found autonomously by Vector.
I've written and recorded PoCs for all three, but they stay private until they're fixed. the second they are, everything goes public. these impact millions of users cumulatively.
Vector is not finding theoretical issues in toy apps. it is finding the highest severity vulnerabilities in real software that real people depend on, faster than a human team ever could, in code that has been public and reviewed without anyone catching it.
we've also updated the zauth landing pages and docs.
CLI is coming along and it will be amazing. more on that soon.
two big technical updates to zauth very soon.
vector cli -
you can run whitebox pentests without leaving your ide. you'll be able to scope it to a subset of your code, a single service, or your entire stack.
vector reads your real source, maps how data flows from your endpoints into dangerous sinks, and confirms which bugs an attacker can actually reach.
when it finds a live target it fires a real exploit to prove the vuln on your deployed stack, then writes the patch, applies it, and re-attacks to confirm the hole is closed.
findings are ranked by proof, so a confirmed exploit sits at the top and unproven guesses get downgraded automatically (or manually, if it misses anything).
it reads dependency cves the same way, telling you which package is reachable through which route instead of drowning you in a 20-item audit dump.
big codebases are fine too, since the engine only ever looks at the tight path around each finding, so it scales to millions of lines.
grok bot -
finally, i am building something that's never been done before with @bot. can't leak this one unfortunately, but i build quick.
very excited to make these public.
zauth will take over.
will retweeted
Ran a pentest on our web app with @zauthinc and was seriously impressed.
Being able to actually watch it navigate the app and run tests in real time makes the whole process way more interesting and interactive. It surfaced some useful findings for us too.
Excited to see where the team takes it from here.
none of these came from scanner output - was purely from auditing deltas.
so excited to announce this orchestration at some point - we are preparing to make apex fully autonomous.
We are four days into Project Apex and we have already disclosed two critical vulnerabilities in software that many users and companies depend on.
--
The first is a SQL injection in a widely deployed file transfer server, running on roughly 160,000 machines currently exposed to the internet, and it requires no account or credentials of any kind to reach.
The fix already existed upstream, but had simply never been carried into the release branch that people download, so every administrator on the current stable version was exposed while the patch sat on a branch they had no reason to look at.
The maintainer is patching it now and we will publish the full proof of concept once that lands.
--
The second is a remote code execution vulnerability in a widely used open source platform with 70,000 downloads, reachable with no login, no password, and no action required from anyone at the target company.
It is reported and we are still waiting to hear back from the company.
We are holding both names until the fixes are in shipped releases and users have had a chance to update.
--
Both findings came out of Vector, our agentic pentesting engine we spent eight months building. Until four days ago it was private, run only on businesses that came to us directly. Now it is pointed at open source code across the internet
This is the tip of the iceberg.
Project Apex is 3 days old and has already reported its first major vulnerability: an unauthenticated, zero-click RCE with a CVSS 10.0.
the repo has over 70,000 downloads.
full writeup once it's fixed.
The best hackers on the internet don't work for you, but starting now, one of them does.
We built an agent that hunts vulnerabilities like an attacker does. Until now it's only run where a customer asked.
Introducing Project Apex.
We're unleashing Vector on production systems, and we're going to find serious vulnerabilities. Smart contracts, repositories, packages, you name it.
We published a benchmark where our engine outperformed a far larger incumbent, but a paper only proves so much. A benchmark is a controlled room. The field isn't. The gap between "best on paper" and "best in practice" is where security tools fail, and the only way to close it is to show our work publicly.
The benchmark is our claim. We've built one of the most powerful pieces of cyber defense on the internet.
Apex will be the receipt.
will retweeted
Congrats to @strix_ai on 50,000 stars for their open-source agentic penetration testing.
Top repository of the week on GitHub, so we benchmarked against them. Same ten production apps, same source access, and same model.
zauth found 4.5x the vulnerabilities.
Full paper below.
will retweeted
The best hackers on the internet don't work for you, but starting now, one of them does.
We built an agent that hunts vulnerabilities like an attacker does. Until now it's only run where a customer asked.
Introducing Project Apex.
We're unleashing Vector on production systems, and we're going to find serious vulnerabilities. Smart contracts, repositories, packages, you name it.
We published a benchmark where our engine outperformed a far larger incumbent, but a paper only proves so much. A benchmark is a controlled room. The field isn't. The gap between "best on paper" and "best in practice" is where security tools fail, and the only way to close it is to show our work publicly.
The benchmark is our claim. We've built one of the most powerful pieces of cyber defense on the internet.
Apex will be the receipt.
had the pleasure of meeting @programmer at @Ai4Conferences yesterday.
was awesome to meet the father of x402 and even cooler to hear that he was familiar with zauth.
great times ahead. so inspired and ready to continue building this beast larger than ever.
at @Ai4Conferences repping @zauthinc.
it's hard to describe what me and my cofounders have built. zauth beats tools from teams many times our size, whose companies make 8-9 figures.
guarantee you haven't seen cybersec done like this, and know that zauth's just barely begun.
