Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models

projectzero.google | blog | #ai-security | #offensive-security | #llm | #research | #vulnerability-discovery | #project-naptime

Summary

Project Naptime evaluates the offensive security capabilities of large language models, presenting a methodology, tooling setup, and early successes finding real vulnerabilities.
Published
Collected

original ↗

Related coverage

blog · projectzero.google
From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code
How Project Zero evolved Project Naptime into Big Sleep, using large language models to find vulnerabilities in real-world software, with early results and observations.
blog · specterops.io
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.
vulnerability · projectdiscovery.io
Beyond the Model: Neo Hunts, Exploits, and Proves 22 Zero-Days.
LLMs find vulnerabilities fast but flood teams with unverified reports. Neo confirmed 22 CVEs across 13 open source projects at ~10-20% false positives, with working exploits and runtime evidence.
blog · xbow.com
Introducing Autonomous Exposure Management: Offensive Security at Enterprise Scale
XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
blog · projectblack.io
Bypassing EDR with Local AI
A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.
blog · bugcrowd.com
Savant Forge: Automated offensive testing to keep pace with AI-generated code
Bugcrowd's Savant Forge combines fuzz testing with symbolic execution to surface real exploitable vulnerabilities in CI/CD pipelines, while Savant Runtime tracks live third-party components in production to support SBOM compliance.
back