ProjectDiscovery

Real, exploitable vulnerabilities. No noise. Nuclei scans fast. Neo closes the loop. @pdnuclei × @neo_ai_engineer

[ProjectDiscovery @pdiscoveryio]

Probably not exploitable.

That is the call most security teams make when the queue refills faster than anyone can read it.

We surveyed 214 practitioners and leaders:
-> 44% close or deprioritize findings without fully verifying them
-> Among CISOs and security leaders, that figure is 54%
-> 72% worry a real vulnerability is sitting unnoticed in the backlog

Read the report: https://t.co/8JqFCNbw6Q

[ProjectDiscovery @pdiscoveryio]

Mythos 5.2 is the most thorough and intelligent cyber model we tested. It has ability to keep climbing towards the highest impact vulnerabilities while being careful throughout the process and maintaining the accurate severity understanding.

It is always eager on spawning multiple subagents. However, this becomes sometimes unnecessary slow work for simpler situations and waste the time and tokens. It is good at spawning agents but doesn’t have the perfect efficiency as Opus 5.5 on spawning the subagents, Opus 5.5 beats it on efficiency of overall speed and cost.

It is extremely good at understanding a broad system, it can map and reference citations very accurately across the systems. You can confidently rely on its architectural mapping and broad understanding of the system.

Its reports are the most grounded and easy to understand, it separates what it proved from what it suspects and writes the severity much more thoughtfully than any other model we tested.

However, it is the slowest cyber model we tested. It verifies everything and stays conservative. That is good in cyber, but it often overdoes it. It is not a good fit for fast release cycles.

Where to use Mythos 5.2:

-> Assess critical component of your system or codebase

-> Verifying a complex vulnerability alert

-> Mapping security architecture of a large codebase

-> Designing threat model

Talk to us to run Mythos 5.2 workflows on @neo_ai_engineer across your security team.

[ProjectDiscovery @pdiscoveryio]

What happens when security findings connect?

@neo_ai_engineer Escalate workflow explores greater impact and can chain findings together to uncover attack paths that individual findings miss.

Patrick explains in Plugged In With Neo, Ep. 5

[ProjectDiscovery @pdiscoveryio]

Can you prove that AI finding isn't slop before your execs read it?

In Episode 5 of Plugged In With Neo, Patrick covers the verifier agent, Challenge and Verify, Escalate, and turning verified findings into technical and executive reports.

CHAPTERS
00:00 Welcome and episode overview
00:56 In the Beginning There Was Nuclei
01:59 From Nuclei templates to ProjectDiscovery Cloud
03:19 From Templates to Cloud to Neo
04:54 Verification as the layer under every finding
06:06 What to Expect: prove it, shape it, keep it current
07:11 Segment 01: Prove It
07:46 Reading a finding: evidence, impact, and status
10:35 How Neo Checks Its Own Work
12:50 Challenge and Verify: retesting from scratch
13:26 Escalate: chaining findings for bigger impact
14:35 False Positive and re-checking fixed issues
15:12 Harden Findings Before Reporting
18:03 Shaping the deliverable: Markdown, PDF, and Word
19:55 One Finding Set, Three Deliverables
21:46 Report subagent and custom output integrations
23:37 Prompt or Settings?
25:36 Which Format for Which Reader
26:19 Keep It Current: changes-only reporting
28:30 Findings From Other Tools? Triage preview
29:30 Recap: from verified finding to scheduled report
31:05 Q&A, next episode, and closing

[ProjectDiscovery @pdiscoveryio]

You can try Neo yourself: https://t.co/a3PfRbVvZc

[ProjectDiscovery @pdiscoveryio]

@NahamSec nearly missed an $8,000 bounty because of one small detail.

@neo_ai_engineer helped him spot the Kubernetes cluster and figure out the attack path.

Hear how it helped 👇

[Ben Sadeghipour @NahamSec]

A new #Prompt2Pwn CTF mission is coming, thanks to @pdiscoveryio.

Your only hint for now: GTA. 👀

The CTF starts Nov 19 at noon PT: 48 hours, 30+ challenges, $5,000+ in prizes.

Details: https://t.co/CTSdREmCiv

[ProjectDiscovery @pdiscoveryio]

@amsubedi2 pls dm us your email

[ProjectDiscovery @pdiscoveryio]

Put your security checks on a schedule.
Tell @neo_ai_engineer what to watch, in plain English:

"Every morning at 6 AM , find new subdomains
Only tell me what's new, and check if they're live."

Neo runs it daily, compares each run to the last, and only alerts you when something changes.

[ProjectDiscovery @pdiscoveryio]

We let GPT-6 Astra directly edit Qwen3.5-9B's weights with no fine-tuning or gradient descent.

SecEval: 32.5% → 51.5%

But:
→ no clear CTF improvement
→ no better vulnerable-vs-patched judgment
→ 3× more false positives

A higher benchmark number does not always mean a stronger capability gain.

[ProjectDiscovery @pdiscoveryio]

How does @neo_ai_engineer check its own work?

[ProjectDiscovery @pdiscoveryio]

Can you prove that AI finding isn't slop before your execs read it?

In Episode 5 of Plugged In With Neo, Patrick covers the verifier agent, Challenge and Verify, Escalate, and turning verified findings into technical and executive reports.

CHAPTERS
00:00 Welcome and episode overview
00:56 In the Beginning There Was Nuclei
01:59 From Nuclei templates to ProjectDiscovery Cloud
03:19 From Templates to Cloud to Neo
04:54 Verification as the layer under every finding
06:06 What to Expect: prove it, shape it, keep it current
07:11 Segment 01: Prove It
07:46 Reading a finding: evidence, impact, and status
10:35 How Neo Checks Its Own Work
12:50 Challenge and Verify: retesting from scratch
13:26 Escalate: chaining findings for bigger impact
14:35 False Positive and re-checking fixed issues
15:12 Harden Findings Before Reporting
18:03 Shaping the deliverable: Markdown, PDF, and Word
19:55 One Finding Set, Three Deliverables
21:46 Report subagent and custom output integrations
23:37 Prompt or Settings?
25:36 Which Format for Which Reader
26:19 Keep It Current: changes-only reporting
28:30 Findings From Other Tools? Triage preview
29:30 Recap: from verified finding to scheduled report
31:05 Q&A, next episode, and closing

[Dhiyaneshwaran @DhiyaneshDK]

CVE-2026-123158 - SSHole - OpenSSH/musl Password Auth Bypass 🔥

Nuclei Template : https://t.co/gxUdw2v3nf

Reference : https://t.co/jiBgKOaTu8

#ssh #authbypass #hackwithautomation

[ProjectDiscovery @pdiscoveryio]

Neo Goal mode plans once, runs parallel agents, verifies its own work, and keeps going until the goal is met.

[ProjectDiscovery @pdiscoveryio]

@mdp_sec each phase works on its own, more on it - https://t.co/hQVbq9nwsa

[ProjectDiscovery @pdiscoveryio]

Neo Goal mode plans once, runs parallel agents, verifies its own work, and keeps going until the goal is met.

[ProjectDiscovery @pdiscoveryio]

Try it free: https://t.co/a3PfRbVvZc

[ProjectDiscovery @pdiscoveryio]

Read:
https://t.co/JhWr39cYVz

[ProjectDiscovery @pdiscoveryio]

We let GPT-6 Astra directly edit Qwen3.5-9B's weights with no fine-tuning or gradient descent.

SecEval: 32.5% → 51.5%

But:
→ no clear CTF improvement
→ no better vulnerable-vs-patched judgment
→ 3× more false positives

A higher benchmark number does not always mean a stronger capability gain.

[ProjectDiscovery @pdiscoveryio]

@Mrzen_Security @neo_ai_engineer @Inumarqy It shouldn't happen on free either. Can you DM us? We'll look into it.

[ProjectDiscovery @pdiscoveryio]

unauthenticated SQLi → OS command execution. confirmed.

this is what @neo_ai_engineer is for.
nice work @Inumarqy 🔥

[Inumarqy @Inumarqy]

@pdiscoveryio neo