depthfirst Research

Introducing dfbench v1: A cybersecurity benchmark for frontier models and agentic systems

dfbench is the held-out benchmark depthfirst maintains to evaluate frontier models on open-ended defensive security work. It measures whether an agent can provide broad, actionable security coverage at sustainable cost across three objectives: detection, validation, and differential analysis.

Introducing dfs-large1: A New Frontier for Cybersecurity

dfs-large1 is our most capable model to date, designed for vulnerability discovery and validation across large enterprise repositories. Built on GLM 5.2, it was post-trained inside depthfirst's security agent harness using our RL stack.

Raising the bar on security. We invest in research because better performing models lead to stronger security for our customers.

Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem

Through the Open Defense Initiative, depthfirst analyzed roughly 40 Ruby gems and validated 105 vulnerabilities across 34 projects with more than 8.6 billion combined downloads, including flaws that led to remote code execution in GitLab.

Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities

We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.

21 Zero-Days in FFmpeg

depthfirst's production autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, after intensive security analysis by Google and Anthropic. Moving beyond theoretical analysis, our agent produces concrete, reproducible PoC inputs to confirm its findings at a fraction of the costs ($1k vs. $10k). Several of the findings had been sitting latent for 15 to 20 years. We explored the exploitability of the issues and developed a PoC demonstrating a RCE exploit primitive.

NGINX Rift: Achieving NGINX Remote Code Execution via an 18-Year-Old Vulnerability

We used the depthfirst system to analyze the NGINX source code, and it autonomously discovered 4 remote memory corruption issues, including a critical heap buffer overflow introduced in 2008. We further investigated the exploitability of the issues, and developed a working proof of concept demonstrating RCE with ASLR off. If you use rewrite and set directives in your NGINX configuration, you're at risk.

Training State of the Art Vulnerability Discovery Agents through Reinforcement Learning

We introduce dfs-mini1, a security model co-trained with our harness via Reinforcement Learning to detect smart contract vulnerabilities. It achieves Pareto optimality on OpenAI's EVMBench Detect benchmark and state of the art performance at pass@8.

The Masked Namespace Vulnerability In Temporal CVE-2025-14986

A deep dive into CVE-2025-14986, a masked namespace vulnerability in Temporal that enabled cross-tenant policy and schema confusion via bundled APIs.

1-Click RCE To Steal Your OpenClaw Data and Keys (CVE-2026-25253)

A technical teardown of a 1-click RCE against OpenClaw (formerly Moltbot/ClawdBot), a viral open-source AI assistant trusted by 100,000+ developers with high-privilege access. See how a settings logic flaw and a WebSocket pivot turn a single webpage visit into token exfiltration, safety-control bypass, and arbitrary command execution.

ALPC You Later: CVE-2025-64721 Sandbox Escape Smashing The Heap Over IPC

An in-depth analysis of CVE-2025-64721, a critical Sandboxie sandbox escape caused by a 32-bit integer overflow in raw ALPC IPC. Learn how a missing bounds check enabled heap leaks, 4GB heap corruption, and SYSTEM-level code execution on Windows—and what this vulnerability teaches about real-world exploitation and low-level security design.

Our Approach to Coordinated Vulnerability Disclosure

depthfirst is finding new security vulnerabilities in open-source software every week. And we believe that finding these vulnerabilities is only valuable if it leads to a safer internet. We created this policy to clarify how we handle these public discoveries: ensuring maintainers have the time they need to fix issues, while ensuring users aren't left vulnerable.

Agent Capability Is a System Design Problem: Lessons From a 90% Improvement on CyberGym

depthfirst achieved a ~90% improvement on the CyberGym vulnerability-exploitation benchmark by redesigning the system around the model rather than relying on naïve prompting. By adding accurate situational context, real-time runtime instrumentation, and a modular multi-agent architecture, they raised success rates from the historical 20–28% range to 53%. The core takeaway: LLM capability is often bottlenecked by system design, and thoughtfully engineered agents can unlock far more performance than model upgrades alone.

Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization

In 2022, a subtle XSS bug slipped into esbuild, one of the most widely used JavaScript bundlers on the planet. Despite billions of downloads, it remained unnoticed, hiding inside a function that appeared to safely escape HTML. But a missing quote escape created a surprising vector: a malicious folder name that could break out of an HTML attribute and execute arbitrary JavaScript inside the esbuild dev server. The bug lived quietly for years. The fix was one line. Here’s how depthfirst found it, exploited it, and patched it.

Anatomy of an Automated Patch: Fixing a File Upload RCE CVE-2025-59304

The best security alerts are the ones that come with a fix. Our platform recently discovered and automatically generated a patch for a critical RCE in Swetrix Web Analytics. This post dissects the vulnerability (a classic Path Traversal), the exploit, and the code for the automated patch.‍

Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419)

Our agents discovered the vulnerability, provided a risk assessment, and generated a patch autonomously. I shared the results with the Netty maintainers who assigned CVE-2025-59419 and merged our fix.

How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Study

We recently discovered a textbook example of this in Langfuse, a leading open-source LLM engineering platform with 16k stars on Github. A subtle flaw in its background job controls allowed any authenticated user to access highly sensitive administrative functions, creating a significant business risk

We find and report real vulnerabilities in open source projects to help secure the software ecosystem.

vulnerabilities validated
open-source projects

null pointer dereference in uninitialized native node wrappers

use-after-free in cached attribute child nodes during value replacement

use-after-free via dtd root reattachment

use-after-free in xinclude processing

heap use-after-free in document encoding setter

use-after-free in xpath context via missing gc mark

out-of-bounds read in node set indexing

use-after-free in aggregate function callbacks

use-after-free when redefining functions with different arity

unauthorized lock release in read-write lock

infinite loop in AtomicReference#update via NaN values

mutual exclusion bypass via read-count overflow

malformed host header remote denial of service

dos via unbounded integer growth in legacy parsers

memory exhaustion via compression bypass

handshake memory exhaustion via excessive headers

message corruption via protocol length headers

resource limit bypass via message compression

use-after-free in Buffer#clear enables cross-buffer disclosure

stack buffer overflow in dump via large indent

heap buffer overflow in exception serialization

use-after-free in Doc iterators via reentrant close

use-after-free in parser callback via input mutation

use-after-free in parser symbol key cache toggle

negative-size memcpy in create_id attribute handling

use-after-free in parser class gc marking

use-after-free in parser long-key callback

integer overflow in load 2gb string handling

1-click rce via gatewayUrl

type confusion

object lifecycle issue

rce via dir traversal

smtp injection

dos

sandbox escape via heapo

cross-tenant metadata read, policy bypass

heap overflow in mpegts demuxer

integer overflow in swscale

stack overflow via preset recursion

heap overflow in yuv4mpeg encoder

stack overflow in mpegts muxer

heap overflow in h.263 encoder

heap overflow in image2 muxer

heap overflow in vp9 decoder

heap overflow in dash demuxer

pre-authentication heap overflow in stream script engine

heap buffer overflow in rewrite script engine

excessive memory allocation in scgi and uwsgi modules

use-after-free in ssl ocsp resolver handling

out-of-bounds read in charset filter

remote worker dos in mod_proxy_ftp

out-of-bounds read in merge_response_headers

memory disclosure in mod_ssl ocsp

heap overflow in mod_xml2enc

integer overflow in mod_dav lock

heap overflow in mod_dav_fs

heap uaf in mod_proxy_html

heap buffer overflow in reverse cookie path mapping

heap overflow in regex name parser

use-after-free during host-key change on rekey

sandbox escape via malicious container image

l7 rest policy bypass via path traversal

ssh proxycommand shell injection via gateway response

heap overflow in x.509 cert parser

use-after-free in ipv6 multicast query processing

out-of-bounds write via xfrm mtu underflow

Research