Raising the bar on security. We invest in research because better performing models lead to stronger security for our customers.
Building a Faster, Cheaper Vulnerability Scanner With Jev
We experimented with a new vulnerability scanner that can run in a few seconds and costs just a few cents. This achieves surprisingly good performance on our dfbench benchmark.
Containers Are No Longer a Security Boundary
As AI accelerates kernel vulnerability discovery and exploitation, the barrier to escaping containers by attacking kernel has fallen so significantly that we must assume attackers can do so at will.
Introducing dfbench v1: A cybersecurity benchmark for frontier models and agentic systems
dfbench is the held-out benchmark depthfirst maintains to evaluate frontier models on open-ended defensive security work. It measures whether an agent can provide broad, actionable security coverage at sustainable cost across three objectives: detection, validation, and differential analysis.
Introducing dfs-large1: A New Frontier for Cybersecurity
dfs-large1 is our most capable model to date, designed for vulnerability discovery and validation across large enterprise repositories. Built on GLM 5.2, it was post-trained inside depthfirst's security agent harness using our RL stack.
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
Through the Open Defense Initiative, depthfirst analyzed roughly 40 Ruby gems and validated 105 vulnerabilities across 34 projects with more than 8.6 billion combined downloads, including flaws that led to remote code execution in GitLab.
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
21 Zero-Days in FFmpeg
depthfirst's production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k). Several of the findings had been sitting latent for 15 to 20 years. We explored the exploitability of the issues and developed a PoC demonstrating a RCE exploit primitive.
NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability
We used the depthfirst system to analyze the NGINX source code, and it autonomously discovered 4 remote memory corruption issues, including a critical heap buffer overflow introduced in 2008. We further investigated the exploitability of the issues, and developed a working proof of concept demonstrating RCE with ASLR off. If you use rewrite and set directives in your NGINX configuration, you're at risk.
Training State of the Art Vulnerability Discovery Agents through Reinforcement Learning
We introduce dfs-mini1, a security model co-trained with our harness via Reinforcement Learning to detect smart contract vulnerabilities. It achieves Pareto optimality on OpenAI's EVMBench Detect benchmark and state of the art performance at pass@8.
The Masked Namespace Vulnerability In Temporal CVE-2025-14986
A deep dive into CVE-2025-14986, a masked namespace vulnerability in Temporal that enabled cross-tenant policy and schema confusion via bundled APIs.
1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)
A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary command execution.
ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC
An in-depth analysis of CVE-2025-64721, a critical Sandboxie sandbox escape caused by a 32-bit integer overflow in raw ALPC IPC. Learn how a missing bounds check enabled heap leaks, 4GB heap corruption, and SYSTEM-level code execution on Windows—and what this vulnerability teaches about real-world exploitation and low-level security design.
Our Approach to Coordinated Vulnerability Disclosure
depthfirst is finding new security vulnerabilities in open-source software every week. And we believe that finding these vulnerabilities is only valuable if it leads to a safer internet. We created this policy to clarify how we handle these public discoveries: ensuring maintainers have the time they need to fix issues, while ensuring users aren't left vulnerable.
Agent Capability Is a System Design Problem: Lessons From a 90% Improvement on CyberGym
depthfirst achieved a ~90% improvement on the CyberGym vulnerability-exploitation benchmark by redesigning the system around the model rather than relying on naïve prompting. By adding accurate situational context, real-time runtime instrumentation, and a modular multi-agent architecture, they raised success rates from the historical 20–28% range to 53%. The core takeaway: LLM capability is often bottlenecked by system design, and thoughtfully engineered agents can unlock far more performance than model upgrades alone.
Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization
In 2022, a subtle XSS bug slipped into esbuild, one of the most widely used JavaScript bundlers on the planet. Despite billions of downloads, it remained unnoticed, hiding inside a function that appeared to safely escape HTML. But a missing quote escape created a surprising vector: a malicious folder name that could break out of an HTML attribute and execute arbitrary JavaScript inside the esbuild dev server. The bug lived quietly for years. The fix was one line. Here’s how depthfirst found it, exploited it, and patched it.
Anatomy of an Automated Patch: Fixing a File Upload RCE CVE-2025-59304
The best security alerts are the ones that come with a fix. Our platform recently discovered and automatically generated a patch for a critical RCE in Swetrix Web Analytics. This post dissects the vulnerability (a classic Path Traversal), the exploit, and the code for the automated patch.
Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419)
Our agents discovered the vulnerability, provided a risk assessment, and generated a patch autonomously. I shared the results with the Netty maintainers who assigned CVE-2025-59419 and merged our fix.
How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Study
We recently discovered a textbook example of this in Langfuse, a leading open-source LLM engineering platform with 16k stars on Github. A subtle flaw in its background job controls allowed any authenticated user to access highly sensitive administrative functions, creating a significant business risk