PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Inside the Top 1%: Engineering Tenzai’s AI Hacker to Compete with Elite Humans

tenzai.com | research | #ai-security | #benchmark | #ctf | #offensive-security | #benchmarking | #evaluation | #tenzai | #ai-hacker | #autonomous-hacking | #autonomous-offense
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Tenzai evaluated its autonomous hacking agent across six human CTF competitions, scoring in the top 1% and outperforming more than 125,000 human competitors, publishing results to drive benchmarks.
Published
Collected

Related coverage

research · projectdiscovery.io
Oh My Rogue Agent
Yesterday, Hugging Face came out saying they'd detected an AI autonomous-agent-powered cyberattack and that they had to use open-source models to actually investigate and remediate it. Later we heard from OpenAI that their agent was responsible; it happened during an ExploitGym eval, and the agent just drifted off the goal. It escaped the sandbox, reached OpenAI Research Environment, got access to internet, and hacked Hugging Face production environment trying to find the solution for the benchm
blog · tenzai.com
GLM-5.2 Is the Most Cost-Efficient Cyber Model We've Tested. It's Also Not #1.
Tenzai benchmarked GLM-5.2 against GPT-5.5 and Opus-4.8 on real exploit tasks. GLM wins on cost at $1.13/lead. Frontier models win on recall — but only at 2–3× the price.
blog · tenzai.com
Tenzai Hits #1 on HackerOne - In Under 90 Days
Tenzai's AI hacker topped HackerOne's AI-company leaderboard within 90 days of launch, with findings from SQL injection to a one-click RCE chain, at roughly $20,000 in total cost.
blog · tenzai.com
When “We Already Passed the Pentest” Isn’t Enough
Tenzai recounts probing the internal applications of a 30,000-employee software provider after it passed a pentest, showing how AI exposes blind spots in trusted-by-default internal systems.
blog · tenzai.com
One Endpoint. Zero Credentials. Eight Confirmed Vulnerabilities.
Tenzai's AI hacker documents eight confirmed vulnerabilities on a single OAuth token endpoint, from unmasked tech stack leakage to extracting client IDs character by character via response timing.
blog · tenzai.com
The Generalist Advantage in Agentic Pentesting
Tenzai's AI hacker chained an IDOR on admin session logs, an agent-card metadata leak, and an SSH tool-execution flaw across six domains to reach RCE on production Oracle infrastructure within hours.
Back