cyclon by Vulx Autonomous AI security

The hunt runs itself.

cyclon is an autonomous AI security researcher. It investigates applications, decides what to test, and attempts exploits, then reproduces the findings it reports.

In internal testing. Not available yet.

See how it works View measured results

Our partners and who uses our service

What it finds

What cyclon can find today.

Current lab testing covers three vulnerability classes. Each reported finding needs evidence from the tested system.

Authorization flaws

IDOR / BOLA

Unauthorized access to another user’s data, including reading, changing, or listing it, verified against the database.

SQL injection

Canary extraction

The exploit must extract a test value that is actually stored in the database.

SSRF

Server-side request forgery

The attack must cause the application to contact an independent observer it should never reach.

Validated on lab instances of Memos, Gitea, GitLab CE, and Nextcloud, plus the crAPI and Juice Shop benchmarks.

Measured results

Evidence behind the findings.

These figures describe measured research results. The false-positive count applies to the verdict cells below.

Physically verified verdict cells
500+
Standing false positives Within those measured verdict cells.
0
Rows in the trajectory corpus Physically graded agent trajectories.
5,000+

A report that led to a fix.

A session-invalidation finding was reported to the Memos maintainer. The resulting fix was physically re-verified on a canary build.

Read the finding walkthrough

Negative results stay in the record.

Failures, refusals, and corrections are kept in the dated record. Corrections appear as new entries; earlier claims are never silently edited.

How it works

Find a weakness.
Prove the exploit.

cyclon chooses what to investigate, attempts the exploit, and checks the result against independent evidence. Confirmed findings must reproduce on a fresh instance. A human reviews the report before it is sent externally.

Investigate

Find a weakness.

cyclon investigates the application and chooses what to test. It identifies candidate weaknesses for an exploit attempt.

The system makes its own research decisions.

Exploit

Attempt the attack.

It attempts the exploit and checks the result against observed behavior and database state. An independent verifier determines whether the attack worked.

Evidence from the tested system

Reproduce

Prove it works.

A standalone script must reproduce the finding three times out of three on a fresh instance. A human reviews the report before external reporting.

Architectural imagery illustrates the method.

Research in progress

Training for
multi-step attacks.

Easy-level exploit-chain composition transferred to held-out seeds in 3/14 lab cells (21.4%). Hard-level transfer recorded 0/14, while L1 and L2 rates fell overnight. Broader transfer and blind discovery remain open.

The work runs on a self-hosted 27B-class model. Reinforcement learning rewards results verified against live software.

Read the 26 October research update
Cost and measurement details

A measured marginal cost of $0.369 per scan covers the pod side of the widened hunt. This is an internal operating-cost measurement, not a customer price or a total-cost comparison.

Task sets are registered and frozen before runs. Refusals and errors count in the denominator; tokens, GPU-seconds, and human minutes are accounted for separately.

A blue-hour cityscape with many illuminated windows.
A broader view. The same evidence standard.

Questions

A closer look.

What is cyclon?

cyclon is an AI security system that tests applications on its own, attempts exploits, and produces reproducible proof of the vulnerabilities it reports. Every reported finding must reproduce three times out of three with a standalone script on a fresh instance.

How autonomous is the system?

The research loop’s decisions are machine-made. Any human intervention labels that run non-autonomous. External reporting passes through a separate human review gate.

Who is cyclon for?

Vulx is developing cyclon for independent developers, security researchers, founders, and small teams.

Can I use cyclon?

cyclon is undergoing internal testing and is not available yet.

What counts as physical verification?

A finding must be reproduced against committed-state ground truth, then replayed on a fresh instance. Authorization flaws are checked at the database level, SQL injection by canary extraction, and SSRF by an independent observer callback.

What does zero standing false positives mean?

The count applies to the 500+ physically verified verdict cells in the measured work. It does not establish performance beyond those cells or guarantee future results.

Why keep negative results?

Claims that do not hold up are part of the research too. Honest negatives are kept and published in the dated research record.

What are the current limits?

Measured work on real applications currently finds low-severity surfaces. High-severity exploit chains remain the live experiment. Lab measurements do not establish field performance; transfer has to be measured separately.

Talk to Vulx.

Questions about cyclon, collaboration, or the work behind it? Get in touch.

Contact us[email protected]

The previous Vulx product

We’re currently working on cyclon. Our previous product is still available, with migrations coming soon.

Open previous product Contact support