Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify

projectdiscovery.io | tool | #ai-security | #bug-bounty | #ai-agents | #llm | #security-automation | #projectdiscovery | #neo | #agent-architecture

Summary

Neo evolved from a sandboxed agent into a plan-execute-verify architecture with parallel subagents, driven by context, duration, and quality limits. Longest runs hit 14.7 hours and 2,398 tool calls.
Published
Collected

original ↗

Related coverage

tool · projectdiscovery.io
Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught
Part 2 of the vibe coding benchmark dissects three AI-built apps (healthcare, banking, insurance), detailing what Neo caught, what Claude Code got wrong, and what both missed on AI-generated code.
vulnerability · projectdiscovery.io
Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.
LLMs find vulnerabilities fast but flood teams with unverified reports. Neo confirmed 22 CVEs across 13 open source projects at ~10-20% false positives, with working exploits and runtime evidence.
tool · projectdiscovery.io
Neo v1 is now available for everyone
Neo v1 is out of beta: an autonomous security platform that runs continuous exploitability testing across applications, APIs, repositories, cloud accounts, and the internal network, all from one org-wide context layer.
blog · projectdiscovery.io
Continuous PR Security Review
Post-mortem vulnerabilities often look harmless in the diff—they only surface at runtime. ProjectDiscovery says LLM code review hits just 63% precision, so PRs need validation on a running app.
vulnerability · projectdiscovery.io
Nuclei Templates - April 2026
Nuclei Templates v10.4.2 and v10.4.3 ship 226 new templates covering 123 CVEs—about 10 actively exploited KEV entries—and push deeper into AI/LLM attack surface with 27 first-time contributors joining.
vulnerability · projectdiscovery.io
How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code
Neo independently found an SSRF in Faraday, the popular Ruby HTTP client: a URL like //evil.com overrides the destination host. Tracked as CVE-2026-25765 (CVSS 5.8), fixed in Faraday 2.14.1.
back