Credited systems in the public record.

Claude Mythos Preview

Anthropic's restricted cyber-capable frontier model, with public credits across FreeBSD, Firefox, curl, Squid, Symfony, and Project Glasswing's CVD ledger.

• Indexed entries6
• CVE IDs tracked68
• Critical/high entries3

Google Big Sleep

The first public AI vulnerability-research agent with accepted real-world findings across SQLite, Chrome V8, and Apple WebKit.

• Indexed entries8
• CVE IDs tracked22
• Critical/high entries7

Google Gemini security review agents

Gemini CLI and experimental Gemini review agents with explicit discovery credits in accepted Linux kernel fixes.

• Indexed entries2
• CVE IDs tracked4
• Critical/high entries2

Microsoft MDASH

Microsoft's multi-model agentic scanning harness, credited by Microsoft with 16 public CVEs across Windows networking and authentication code.

• Indexed entries2
• CVE IDs tracked16
• Critical/high entries1

OpenAI ExploitGym Evaluation Agents

A long-horizon cyber-capability evaluation in which OpenAI models autonomously discovered and chained real zero-days across OpenAI and Hugging Face infrastructure.

• Indexed entries1
• CVE IDs tracked0
• Critical/high entries1

Z.AI GLM

Z.AI's GLM models now have direct upstream discovery credits across FreeBSD kernel and userland advisories and Apple WebKit.

• Indexed entries3
• CVE IDs tracked10
• Critical/high entries3

AISLE

An autonomous security analyzer with a large public registry and validated credits across OpenSSL, FreeBSD, curl, Apache, Chrome, Squid, and other projects.

AISLE CVE discovery registry 392 unique CVE IDs exposed

• Indexed entries20
• CVE IDs tracked186
• Critical/high entries11

Claude / Anthropic Research

Public Claude-assisted disclosure credits outside the Mythos-only record, spanning browsers, operating systems, cryptography, office documents, cloud auth, CMSs, and Microsoft/Apple platform bugs.

• Indexed entries29
• CVE IDs tracked135
• Critical/high entries22

GitHub Security Lab Taskflow Agent

GitHub Security Lab's open-source AI-powered audit framework, with human-validated advisories across major web applications and frameworks.

GHSL Taskflow and named GHSL-agent advisory audit 44 public advisory pages

• Indexed entries3
• CVE IDs tracked24
• Critical/high entries3

OpenAI Daybreak

OpenAI's defensive vulnerability-research program, combining frontier cyber models, Codex Security, expert validation, and coordinated patching.

• Indexed entries7
• CVE IDs tracked11
• Critical/high entries5

Xint Code

The AI-assisted vulnerability research system credited in CopyFail, with a broader public record spanning Linux, Apple platform, PostgreSQL, and tracker-backed findings.

Xint public bug tracker 53 public tracker rows

• Indexed entries10
• CVE IDs tracked24
• Critical/high entries7

A Security

An autonomous offensive-security platform publicly tied to the Zoomsday zero-click RCE campaign in closed-source Zoom clients.

• Indexed entries1
• CVE IDs tracked2
• Critical/high entries1

BynarIO AI

Bynario's AI-driven vulnerability-research pipeline, with direct Apple and Linux upstream credits across binary analysis, kernel discovery, validation, and patching.

• Indexed entries11
• CVE IDs tracked11
• Critical/high entries9

Sashiko

An agentic Linux kernel review service whose public reports now appear in accepted upstream fixes for memory corruption, use-after-free, information exposure, and validation failures.

• Indexed entries1
• CVE IDs tracked0
• Critical/high entries1

V12

Zellic's agentic security platform, with accepted findings across the Linux kernel, PostgreSQL, Redis, Dolphin, and Web3 infrastructure.

• Indexed entries7
• CVE IDs tracked2
• Critical/high entries5

DepthFirst

DepthFirst's autonomous low-level-code analysis platform, with accepted NGINX, FFmpeg, and Apache HTTP Server campaigns.

• Indexed entries5
• CVE IDs tracked21
• Critical/high entries3

Nebu

NebuSec's AI-native vulnerability-research pipeline, with a public fixed-record ledger spanning Linux, Firefox, Chromium, runtimes, servers, Android, Windows, and embedded devices.

NebuSec public bug list 1,178 public tracker rows

• Indexed entries3
• CVE IDs tracked153
• Critical/high entries3

Striga AI

Striga's AI-based source-code auditing platform, with public CVE credits and research write-ups across Apache httpd, Tomcat, Ollama, axios, and Mattermost Desktop.

Striga CVE tracker 21 public CVE records

• Indexed entries4
• CVE IDs tracked21
• Critical/high entries2

ZeroPath AI SAST

ZeroPath's AI-native SAST and security-research workflow, with public CVE-backed and upstream-patched findings across ProFTPD, Spinnaker, better-auth, FFmpeg, sudo, and other open-source projects.

ZeroPath Wall of Fame 47 fixed public records

• Indexed entries8
• CVE IDs tracked14
• Critical/high entries8

XBOW

An autonomous AI-driven penetration-testing platform with public bug-bounty milestones, critical Microsoft and Exim RCE reports, and direct Chrome credits.

• Indexed entries5
• CVE IDs tracked7
• Critical/high entries5

Palo Alto frontier AI scan

Palo Alto Networks' May 2026 frontier-model scan wave, reported as 26 CVEs across more than 130 products, with exact per-CVE model attribution unpublished.

• Indexed entries1
• CVE IDs tracked26
• Critical/high entries1