autonomous AI security agents that audit your codebase, prove exploitable vulnerabilities, and deliver fixes your team can ship.
San Francisco
Joined December 2023
- Tweets49
- Following1
- Followers2.3K
- Likes50
winfunc retweeted
CVE-2026-112512!
We discovered a 0-day in macOS that lets you trivially bypass Gatekeeper checks for any app.
A gatekeeper bypass that requires no extra interaction, with quarantine bit intact, and passes the Safari download flow.
Essentially checks off all the criteria required for a complete Gatekeeper bypass on macOS, which according to Apple is worth $100K? We shall wait and see.
Will def do a write-up on this soon!
winfunc retweeted
I have been thinking about "AI defense" and "safeguards" for a while now @winfunction.
Just wrote an essay to put my thoughts into words.
Titled: Cyber guardrails tax the defender, not the attacker.
Link in the replies.
winfunc retweeted
as of recent, i've been obsessed with formal verification, specifically on breaking them.
out of curiosity, i ran winfunc on lean4 and it discovered the following UAF (use-after-free): github.com/leanprover/lean4/…
got quickly pached too! :)
winfunc retweeted
Introducing ENDGINX - 5 CVEs in NGINX with open models.
We let loose GLM 5.1 and 5.2 by @Zai_org on the NGINX codebase.
The work resulted in six fixed vulnerabilities across five CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, and CVE-2026-42533.
First of our open-model vulnerability research series.
winfunc.com/research/endginx
winfunc retweeted
We discovered the same vulnerability too. :)
And @winfunction discovered 4 more remote RCE primitives in NGINX soon to be publicly disclosed.
Anywho, we're hiring security researchers with a knack on taming LLMs.
If you're interested in novel vulnerability research and autonomous exploitation with language models, DM me and I'll send you a fun CTF to solve. :)
Introducing nginx-poolslip, a fresh RCE for the the latest nginx release 1.31.0.
nginx-rift has been patched, but our security agent Vega has found a new 0 day.
We will release the full technical writeup with ASLR bypass 30 days after the patch on nebusec.ai.
winfunc retweeted
We're doing an experiment with open models @winfunction to see how far we can push them to find vulns in hardened targets. So far:
- $4.5K in bounties from Chrome VRP with a few more pending, with the scans costing less than $100.
- 2 CVEs in NGINX (CVE-2026-28755 & CVE-2026-42926). And watch out for the next release!
- And 60ca500faea0fc70816bb9c53af3815e2af3e6c962b4b4ea63c33c62ebb4240d 👀
We're writing a blog on this soon.
winfunc retweeted
During our YC (@ycombinator S24) batch, we had the awesome opportunity to meet @paulg and talk about what we're building: An autonomous AI hacker.
To showcase a fun demo, I remember opening my laptop in the Uber to his home and challenging our agents to find vulnerabilities in the old HackerNews codebase written in Arc.
For those unfamiliar, Arc is a programming language designed by PG and Robert Morris. And the old HN codebase is written in Arc.
We only got to talk about it with him but we just redid the experiment with our improved harness for fun!
And we wrote a blog about it: winfunc.com/research/hacking…
winfunc retweeted
Vulnerability benchmarks rot. Cases leak into training data, scores measure memorization.
We built N-Day-Bench: tests LLMs on finding real vulnerabilities in real repos, refreshed monthly from live GitHub advisories. Blinded judging. All traces public.
Very interestingly, the latest model from @Zai_org, GLM 5.1 performs really well!
Link: ndaybench.winfunc.com
winfunc retweeted
New CVE in NGINX - CVE-2026-28755
NGINX stream module allows TLS handshake to succeed with revoked client certificates when ssl_ocsp on is configured.
This vulnerability was autonomously discovered by Winfunc's AI agent.
Read the write-up here: winfunc.com/findings/CVE-202…
winfunc retweeted
Node.js disclosed a bug submitted by @winfunction: hackerone.com/reports/346515… #hackerone #bugbounty
winfunc retweeted
The Recent CVEs in React and Node.js Were Found by an AI - winfunc.com/blog/recent-0-da…
In December 2025 and January 2026, an AI system autonomously discovered zero-day vulnerabilities in Node.js and React, two of the most widely deployed JavaScript runtimes and frameworks in the world.
This post documents how these vulnerabilities were found, the technical details of the flaws, and what this means for the future of security research.
winfunc retweeted
The Recent 0-Days in Node.js and React Were Found by an AI winfunc.com/blog/recent-0-da…
winfunc retweeted
New blog post: The Recent 0-Days in Node.js and React Were Found by an AI
Covering the discovery of 0-days with AI, its implications, and "AI slop". Have a read.
winfunc.com/blog/recent-0-da…
winfunc retweeted
A new vulnerability in React Server Components (CVE-2026-23864) was disclosed today.
One of the DoS vectors was discovered by me with the help of an AI agent @winfunction.
Other vectors were also discovered by @ryotkak et al.
All users should upgrade to a patched version as soon as possible.
vercel.com/changelog/summary…
winfunc retweeted
🚨 CVE-2026-21636 in Node.js (@nodejs)
Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)
This vulnerability was autonomously discovered by winfunc.com, an AI agent that can find, exploit, and patch security vulnerabilities in codebases.
Thanks to @_rafaelgss for triaging and fixing the issue.
winfunc retweeted
this is how long it took for the @winfunction agent to find and exploit a gnarly 0-day in a critical software. we'll write about it soon!
can't wait to show off what we've been cooking! 🥷
winfunc retweeted
Over five years ago, I started publishing the top trending open-source startups every quarter — the ROSS Index. It has become a handy tool for 60K+ developers, founders, and other OSS fans who have visited it to date.
Today, I'm thrilled to make it even more useful, as we are open-sourcing all its data for more than 20 quarters on GitHub, in a convenient format. Explore our repo and star it to be notified about new index releases.
And, of course, now is also the time to reveal the fresh top 20 startups by GitHub stars growth for Q3 2025 — one can find more details on them in the repo too!
winfunc retweeted
Announcing Opcode!
Claudia is now Opcode. A complete revamp with bold plans moving forward.
We're working on a coding agent that exclusively uses open models while achieving SOTA performance on coding benchmarks. Most importantly, it's built to be customizable.
We're piloting this at companies/enterprises requiring fully local on-prem coding agents. They're using it for automated code reviews, SAST, and what have you. If you're one of them, feel free to reach out to us and we'll set this up for you!
And if you want to beta test the agent, check the quoted tweet for info on how to access.
Announcing Opcode
Everyone's favorite Claude Code GUI Claudia is now Opcode... with a complete revamp.
And we just hit 15K+ stars on GitHub! The support from the community has been immense! ❤️
What's new:
- Feature parity with all new Claude Code features in the CLI.
- A complete UI revamp, faster and cleaner.
What's coming:
- Opcode's own coding agent that exclusively uses open models while achieving SOTA performance on coding benchmarks.
We're currently piloting this at companies requiring fully local on-prem coding agents. If you're one of them, reach out to us and we'll set this up for you!
Try Opcode at opcode [dot] sh
Like/retweet and reply to this tweet with "join" to get an invite to the Discord server and beta test our coding agent for free.
winfunc retweeted
Announcing Opcode
Everyone's favorite Claude Code GUI Claudia is now Opcode... with a complete revamp.
And we just hit 15K+ stars on GitHub! The support from the community has been immense! ❤️
What's new:
- Feature parity with all new Claude Code features in the CLI.
- A complete UI revamp, faster and cleaner.
What's coming:
- Opcode's own coding agent that exclusively uses open models while achieving SOTA performance on coding benchmarks.
We're currently piloting this at companies requiring fully local on-prem coding agents. If you're one of them, reach out to us and we'll set this up for you!
Try Opcode at opcode [dot] sh
Like/retweet and reply to this tweet with "join" to get an invite to the Discord server and beta test our coding agent for free.
winfunc retweeted
Inviting early beta testers for our upcoming SWE agent, Asteria.
We're solving AI code comprehension, where the context window and the size of your codebase are no longer limitations, and reinventing the UX of how coding agents are currently implemented.
We initially built this to address false positives and enhance accuracy for our SAST agent, which autonomously identifies security vulnerabilities, traces how a payload would flow through code, and ultimately demonstrates an actual exploit.
The performance improved so significantly that we decided to test it on realistic engineering tasks on large codebases and witnessed SOTA results.
Reply "access" if you'd like to be an early beta tester, a lot of quirks to fix.