Sybil

Automating hacker intuition

[Sybil @runsybil]

The way we hack is changing and we're building what comes next

We've raised a total of $40M to create the AI-native platform for offensive security

[Sybil @runsybil]

See Sybil in action with a live demo: https://t.co/ptcjhwfGzT

[Sybil @runsybil]

University of Toronto researchers built an AI worm that broke into ~75% of machines on a simulated 33-machine corporate network in one week, without human intervention.

The worm adapted in real time by reading live vulnerability advisories and finding new exploits on its own. Patch one bug, and you stop a traditional worm. But as the researchers saw with AI-powered worms, they just find another bug. And another.

This was a controlled environment. But the worm ran on open-weight models, which are available for anyone to download. The speed at which attackers weaponize lab demos, like this one, into live exploits has outpaced the speed at which most organizations can patch. Already, many organizations have unpatched known vulnerabilities and yet have avoided getting hacked into oblivion. Now, defenders might have to be right everywhere, all at once, to stop an AI-powered worm.

The conventional response would be: just fix your software. But as RunSybil CEO Ari Herbert-Voss told Fortune, "Most organizations already have more vulnerabilities than they can realistically address," and “The challenge is knowing what actually matters for an attacker to gain control,”

So how can security programs still operating at human-pace due to token budgets, time, and operational constraints fix their software while attackers are moving at machine speed?

Enter Sybil. Sybil accelerates application security by continuously identifying and remediating threats at machine pace, as applications change. Leaders can finally see what's been tested, what's been found, and where the gaps are across their internal and external attack surface.

[Sharon Goldman @sharongoldman]

NEW: Here's why a new AI-powered computer worm could prove to be the stuff of cybersecurity nightmares

Thanks
@cigitalgem
@adversariel
@theonejvo

https://t.co/OgVYpQso2M

[Sybil @runsybil]

today’s best models continue to benefit from a well designed harness. Claude Code will take you far, it just might not be in the direction you want. we’ve solved this with Sybil and we’re hiring researchers and builders who unlock powerful capabilities from language models https://t.co/yIYl6xst2j 4/

[Sybil @runsybil]

we got early access to Opus 4.8 and used it to hack a Nintendo 64 game you forgot about. here's what it didn't find: 1/

[Sybil @runsybil]

but with someone at the wheel who knows what they’re doing? it shines! in a few hours our researcher @sshell_ went from idea to code execution and a reliable exploit. read it here https://t.co/gK4Sfwqm3y 3/

[Scott Stevenson @scottastevenson]

Every company is going to have its customer data hacked by an AI agent in the next 5 years.

The question is: will you run the agent on yourself, or will you wait for an adversary to?

@runsybil (founder @adversariel) is one of the most compelling pitches I’ve come across recently: run agents that continuously attack yourself 24/7, rather than running a penetration test a few times a year.

Every company needs this ASAP.

I grew up as a hacker kid who watched The Matrix too many times. I never caused harm and always reported my findings, but I was fascinated by breaking and bending software.

The key ingredient in hacking is not brilliance, it’s patience. If you try everything, eventually something breaks. As a teenager I had all the time in the world.

AI agents have 1000x more patience and time than a bored 15 year old.

We don’t need Mythos for agents to be a massive security threat. The threat is already here. It is just a matter of time until virtually every company on earth gets hacked by an agent.

The only question is whether you will be the one running the agent, or whether someone else will.

You should talk with @adversariel at @runsybil!

[Sybil @runsybil]

@BonJarber If you've participated in bug bounties, CTF, or have general experience with pentests and web application vulns, apply here: https://t.co/aGJZvUqIIN

[Sybil @runsybil]

We're hiring an entry-level security analyst! Each day is a new adventure with @BonJarber and the other engineers at RunSybil

[Sybil @runsybil]

@dariushoule But seriously, we're hiring for roles that will report directly to our cofounder and CTO, Vlad (@ucsenoi)
• Engineering Manager
• Founding Product Manager
• Technical Program Manager
• SWE
• SRE/Infrastructure Engineer
https://t.co/HvTW11AJB1
3/

[Sybil @runsybil]

Our Friday sitdown started with new headshots and ended with this.
We're hiring. Come join the swamp 1/

[Sybil @runsybil]

Also, welcome to our newest sybilian, @dariushoule, who joined us last week. He's an expert breaker of all things software, retro computer enthusiast, and lowkey graphic designer? Welcome! 2/

[Sybil @runsybil]

Last week, we sat down and interviewed Sybil. You learned they prefer their coffee black and that they are a Scorpio moon. They never trust what's on the surface.

However, Sybil's day job is a little different.

Sybil is a system of agents that attacks applications the way a hacker would. They map the attack surface, uncovering exploits across endpoints, authentication flows, and business logic. Every finding they uncover is validated using a multi-agent
system before it reaches your dashboard. Black-box first, no source code required. But that's just the beginning. Every action Sybil takes is logged, so you can query the agent activity to see exactly where and how it tested anything in your application, and read its reasoning at every step.

Sybil also maintains a persistent model of each application's attack surface. Every engagement builds on the last. Schedule tests on a defined cadence or trigger them automatically based on code changes. Sybil already knows the application, so testing stays up to date without having to start from scratch.

[Sybil @runsybil]

Read what Sybil had to say: https://t.co/sDNObCXD1u

⚠️ Disclaimer: Sybil is a Virgo. Their opinions about your attack surface are not personal.

[Sybil @runsybil]

Read what Sybil had to say: https://t.co/sDNObCXD1u

⚠️ Disclaimer: Sybil is a Virgo. Their opinions about your attack surface are not personal.

[Sybil @runsybil]

We prompted Sybil to introduce themselves. What came back was methodical, opinionated, and included an astrological chart.

[Sybil @runsybil]

Sybil is RunSybil's security authority. They’re a multi-agent system that continuously tests your applications and infrastructure for exploitable vulnerabilities by reasoning about your applications the way an elite researcher would.

[Sybil @runsybil]

What we're seeing with LLMs is what we saw with fuzzers in the 2000s. A flood of findings that still need triaging, validation, and remediation to separate the noise from the true bugs.

CEO @adversariel broke this down at @BlackHatEvents Asia and what it means for defenders.

[Dark Reading @DarkReading]

Parsing Agentic Offensive Security's Existential Threat: https://t.co/jCCU8jOQCq by Tara Seals #BHASIA

[Sybil @runsybil]

If you think AI hacking is hype, you're half right. If you think it doesn't matter yet, you're wrong.

RunSybil CEO, @adversariel, is speaking @defcon Asia today at 3:00PM GMT+8.

This talk is a technical field report that digs into why it's possible for AI to hack. See you then!

[The Register @TheRegister]

It's a myth that you need Mythos to find bugs: Open source models can do it just as well https://t.co/x8CLST8UUp