autonomous AI security agents that audit your codebase, prove exploitable vulnerabilities, and deliver fixes your team can ship.
San Francisco
Joined December 2023
- Tweets49
- Following1
- Followers2.3K
- Likes50
Vulnerability benchmarks rot. Cases leak into training data, scores measure memorization.
We built N-Day-Bench: tests LLMs on finding real vulnerabilities in real repos, refreshed monthly from live GitHub advisories. Blinded judging. All traces public.
Very interestingly, the latest model from @Zai_org, GLM 5.1 performs really well!
Link: ndaybench.winfunc.com
How it works: each month the benchmark pulls fresh cases from GitHub security advisories, checks out the repo at the last commit before the patch, and drops models into a sandboxed read-only shell (h/t just-bash by @cramforce).
The model never sees the fix. It starts from sink hints and has to trace the bug through actual code.
Only repos with 10k+ stars qualify. A diversity pass prevents any single repo from dominating the set. Ambiguous advisories (merge commits, multi-repo references, unresolvable refs) are dropped.
Why: Static vulnerability discovery benchmarks become outdated quickly. Cases leak into training data, and scores start measuring memorization. The monthly refresh keeps the test set ahead of contamination — or at least makes the contamination window honest.
2
1
339
New CVE in NGINX - CVE-2026-28755
NGINX stream module allows TLS handshake to succeed with revoked client certificates when ssl_ocsp on is configured.
This vulnerability was autonomously discovered by Winfunc's AI agent.
Read the write-up here: winfunc.com/findings/CVE-202…
we've a few more up our sleeves. soon. 👾
A new vulnerability in React Server Components (CVE-2026-23864) was disclosed today.
One of the DoS vectors was discovered by me with the help of an AI agent @winfunction.
Other vectors were also discovered by @ryotkak et al.
All users should upgrade to a patched version as soon as possible.
vercel.com/changelog/summary…
4
483
🚨 CVE-2026-21636 in Node.js (@nodejs)
Node.js permission model bypass via unchecked Unix Domain Socket connections (UDS)
This vulnerability was autonomously discovered by winfunc.com, an AI agent that can find, exploit, and patch security vulnerabilities in codebases.
Thanks to @_rafaelgss for triaging and fixing the issue.
Announcing Opcode
Everyone's favorite Claude Code GUI Claudia is now Opcode... with a complete revamp.
And we just hit 15K+ stars on GitHub! The support from the community has been immense! ❤️
What's new:
- Feature parity with all new Claude Code features in the CLI.
- A complete UI revamp, faster and cleaner.
What's coming:
- Opcode's own coding agent that exclusively uses open models while achieving SOTA performance on coding benchmarks.
We're currently piloting this at companies requiring fully local on-prem coding agents. If you're one of them, reach out to us and we'll set this up for you!
Try Opcode at opcode [dot] sh
Like/retweet and reply to this tweet with "join" to get an invite to the Discord server and beta test our coding agent for free.