Editorial illustration for 0sec Labs Open-Sources 0 AI Security Harness With Account-Free Browser Console
0sec Labs Open-Sources AI Security Harness Tool
A Zurich startup called 0sec Labs has put its AI security harness on GitHub, and it's betting developers would rather run vulnerability scans from a browser tab than wire together another agent framework from scratch. The tool, called 0, is licensed under MIT or Apache-2.0 and ships as a research preview, free for anyone to inspect, fork, or point at their own infrastructure.
0 doesn't come with a model attached. Instead it acts as a control plane, letting users plug in one of 14 supported LLM providers and then run that model against authorized targets through a scoped workflow. There's no GPU requirement on the local side, since inference happens wherever the provider's hardware lives. Developers can drive the whole thing three ways: a local browser console that needs no account, a headless CLI for scripting, or an MCP server for hooking into existing agent setups.
The company, backed by Y Combinator, is pitching 0 as a single harness that covers web apps, source code, packages, binaries, and even kernel-level work, with vulnerability investigation, pentesting, reverse engineering, and fix generation all running through the same pipeline.
0 is a control plane around LLMs and security tools. It is not a model. You plug in a provider, and 0 runs scoped workflows against authorized targets.
Why this matters
0sec Labs built 0 to run on a laptop, not a cloud dashboard someone else controls. For developers and security researchers, the no-account browser console and MIT OR Apache-2.0 license matter more than they might sound: nobody has to hand over source code or scan results to a third-party SaaS just to get a pentest or a reverse-engineering pass done. The bring-your-own-LLM setup across 14 providers also means teams can swap in whatever model they trust, or already pay for, rather than being locked to one vendor's API.
The MCP server with nine tools suggests 0sec Labs wants this wired into existing agent workflows, not treated as a standalone app. We'd want to see how 0verse handles compiled targets in practice, and whether a "research preview" on Apple Silicon and x64/ARM holds up against real codebases before teams trust it with production pentesting. Open-sourcing a security harness is a meaningful bet on transparency in a space usually sold as a black-box service.
Whether the findings queue and fix generation are reliable enough to replace a human reviewer is still unproven.
Related Reading
Open Source Study: 6.7% of Deepfake Requests on Hugging Face Targeted Children
Open Source D&B rebuilds 642 million‑business database after AI agents hit limits
Open Source Axiom Math raises USD 200M Series A led by Menlo to keep AI slop out of math
From Archives Apple is racing to make Siri more agentic with third-party app control
From Archives Google AI Releases Elephant-Goldfish Plugin; Issue #237 Reports AGENTS.md Leak
Common Questions Answered
What is 0 and how does it differ from traditional LLM frameworks?
0 is an AI security harness created by 0sec Labs that functions as a control plane for running vulnerability scans and security workflows, rather than being a standalone LLM model itself. Unlike traditional agent frameworks that require complex wiring, 0 allows developers to run security scans directly from a browser console without needing to build infrastructure from scratch. It acts as a coordinator that connects to 14 supported LLM providers, letting users plug in their preferred model to execute scoped security workflows.
What are the licensing options and availability for 0sec Labs' security harness?
0 is open-sourced on GitHub under dual licensing with MIT or Apache-2.0 licenses, making it free for anyone to inspect, fork, or deploy on their own infrastructure. The tool is released as a research preview, allowing developers and security researchers to use it without restrictions or account requirements. This open-source approach ensures that users maintain full control over their source code and scan results without needing to share them with third-party SaaS providers.
How does the bring-your-own-LLM setup work with 0's 14 supported providers?
0 allows teams to select and integrate their preferred LLM from 14 supported providers, enabling flexibility in choosing models that align with their security requirements and existing investments. Users can swap between different models based on trust levels or existing payment arrangements rather than being locked into a single provider. This flexibility means organizations can leverage the LLM infrastructure they already use or pay for, rather than adopting a new proprietary solution.
Why does 0sec Labs emphasize running 0 on a laptop rather than a cloud dashboard?
0sec Labs designed the tool to run locally on a laptop to give developers and security researchers complete control over their infrastructure and data, avoiding dependency on cloud dashboards controlled by third parties. The account-free browser console and local deployment model ensure that vulnerability scan results and source code remain private and under the user's control. This approach is particularly valuable for organizations that need to keep sensitive security testing information on-premises rather than uploading it to external services.
Further Reading
- Papers with Code - Latest NLP Research - Papers with Code
- Hugging Face Daily Papers - Hugging Face
- ArXiv CS.CL (Computation and Language) - ArXiv
