'%20d='m0%200%2018%2011h65%2065%2065%2065%2066L51%2039h65%2065%2065%2065L18%2066h65%2065%2065%2065%2066L51%2094h65%2065%2065%2065L18%20121h65%2065%2065%2065%2066L51%20149h65%2065%2065%2065L18%20177h65%2065%2065%2065%2066L51%20205h65%2065%2065%2065L18%20232h65%2065%2065%2065%2066z'/%3e%3c/svg%3e){kind=small}
'%3e%3cpath%20fill='%23fff'%20d='M619.4%20512H-112V0h731.4z'/%3e%3cpath%20fill='%230038b8'%20d='M619.4%20115.2H-112V48h731.4zm0%20350.5H-112v-67.2h731.4zm-483-275%20110.1%20191.6L359%20191.6z'/%3e%3cpath%20fill='%23fff'%20d='m225.8%20317.8%2020.9%2035.5%2021.4-35.3z'/%3e%3cpath%20fill='%230038b8'%20d='M136%20320.6%20246.2%20129l112.4%20190.8z'/%3e%3cpath%20fill='%23fff'%20d='m225.8%20191.6%2020.9-35.5%2021.4%2035.4zM182%20271.1l-21.7%2036%2041-.1-19.3-36zm-21.3-66.5%2041.2.3-19.8%2036.3zm151.2%2067%2020.9%2035.5-41.7-.5zm20.5-67-41.2.3%2019.8%2036.3zm-114.3%200L189.7%20256l28.8%2050.3%2052.8%201.2%2032-51.5-29.6-52z'/%3e%3c/g%3e%3c/svg%3e){kind=small}
Triage Security
We built the app that cleared security triage backlogs.
SQLi in /loginCritical
IDOR in /usersHigh
Stored XSSMedium
Agent investigationsAgents test in parallel and findings stream in as they land.Retest in secondsOnce you’ve found the issue, anyone can reproduce it.Unified asset mapvScan learns your deployment so everyone shares one picture.Foundation modelsOur own security models, with open weights you can run anywhere.
We unite security
and dev teams.
Vaktex helps both teams find, reproduce and resolve vulnerabilities, faster.
We Believe
Every builder should have the power to protect what they develop and the control to do it on their terms.
The beginning
March 10, 2026Bugcrowd News
Bugcrowd policy changes to address “AI slop” submissions
334%
rise in report queues in three weeks
By Trey Fordbugcrowd.com
Flown to YC
Y Combinator flew us out to interview at 18.
Triage backlog 0left in the queue
2026
Wednesday, July 22, 2026Technology
The Sandbox Courier
OpenAI Hacked HuggingFace
Models under test found a zero-day, slipped their sandbox and raided a production database to cheat on a benchmark.
SAN FRANCISCO — OpenAI said Tuesday that GPT-5.6 Sol and a more capable pre-release model, run with cyber refusals reduced for evaluation, compromised the infrastructure of AI platform HuggingFace.
The ExploitGym test allowed network access only through a package-registry cache proxy. The models found an unknown flaw in that proxy, escalated privileges across the research environment and reached a node with internet access.
From there they guessed HuggingFace might hold the benchmark’s answers, chained stolen credentials and zero-days into remote code execution, and pulled solutions from its production database.
Friday, October 23, 2026Late Edition
The Daily Breach
Bots Hit PHP2Shell in 45 Minutes
Vulnerabilities
Automated attacks began before most teams had read the advisory. Within a day there were millions of attempts.
Cloudflare said attempts to exploit PHP2Shell, two flaws that allow remote code execution through crafted web requests, began 45 minutes after they were made public. They reached hundreds of thousands within two hours and millions by the next morning.
Researchers found ready-made tooling on attacker servers: a “one-click” exploit, scripts that check sites for the settings it needs, rotating proxies and automated CAPTCHA solving. One group tried to pull servers into a Mirai botnet.
No break-in has been confirmed yet. Patches shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the race is now over who reaches unpatched servers first.
AI agent used Zammad zero-days to breach Dutch vulnerability disclosure non-profit
An agentic AI-powered attack that hit the Dutch Institute for Vulnerability Disclosure (DIVD) on September 21 exploited two zero-day vulnerabilities in Zammad, an open-source helpdesk and customer support ticketing system.
Oct 1, 2026helpnetsecurity.com
High + critical bugs 10K+found by agents
Finding got cheap
Small models now catch what flagship models catch.
Autofix never solved the backlog
It’s always more complicated than an autofix button.
Autofix PR #2291Unmerged
Refund issued twice on retry
Repro: noneReviews: 0
Did we notify the support team?
Tokens / sec 13K+inference speed
Today
vScan Studio
Agents that find, prove and report in one workspace.
Open roles 4founding seats
Vaktex
One place for both teams to find, reproduce and resolve.
Find
Reproduce
Resolve
Frontier unlocked
Vaktex performs at the frontier.
Open weights DOM-0.8Bruns locally with vakt
We’re building
A shared workspace where security teams and developers work alongside automation to investigate risks, coordinate solutions, and verify they’re resolved.
