Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.

projectdiscovery.io | vulnerability | #ai-security | #bug-bounty | #zero-day | #offensive-security | #cve | #llm | #vulnerability-discovery | #neo

Summary

LLMs find vulnerabilities fast but flood teams with unverified reports. Neo confirmed 22 CVEs across 13 open source projects at ~10-20% false positives, with working exploits and runtime evidence.
Published
Collected

original ↗

Related coverage

blog · specterops.io
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.
blog · projectzero.google
Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models
Project Naptime evaluates the offensive security capabilities of large language models, presenting a methodology, tooling setup, and early successes finding real vulnerabilities.
vulnerability · projectdiscovery.io
How Neo found an SSRF vulnerability in Faraday, and why it matters for every team that ships code
Neo independently found an SSRF in Faraday, the popular Ruby HTTP client: a URL like //evil.com overrides the destination host. Tracked as CVE-2026-25765 (CVSS 5.8), fixed in Faraday 2.14.1.
tool · projectdiscovery.io
How Neo's Agent Architecture Evolved: From One Agent → Plan, Execute & Verify
Neo evolved from a sandboxed agent into a plan-execute-verify architecture with parallel subagents, driven by context, duration, and quality limits. Longest runs hit 14.7 hours and 2,398 tool calls.
tool · projectdiscovery.io
Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught
Part 2 of the vibe coding benchmark dissects three AI-built apps (healthcare, banking, insurance), detailing what Neo caught, what Claude Code got wrong, and what both missed on AI-generated code.
blog · projectzero.google
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
How Project Zero evolved Project Naptime into Big Sleep, using large language models to find vulnerabilities in real-world software, with early results and observations.
back