We spun out of the #1 hacking team in the US and built AI that finds what even the best hackers miss.
During one engagement, it found 6 different ways to take over any user's account on a popular webapp. Completely autonomously. Then suggested fixes for every single one.
Today we're announcing @verialabs' $3.2M seed, backed by @ycombinator, @gokulr, @paulg, and @woloski (co-founder of Auth0), and many other great investors.
DM me if you want to know what we'd find in your app.
@IntCyberDigest A lot of these “rejected zero-day RCE submissions” are just the result of AI Psychosis and aren’t real vulnerabilities.
Happy to DM for more details, don’t want to publicly put any of these groups on blast.
Multiple security vulnerabilities affecting React Server Components and Next.js have been disclosed. We strongly recommend updating your applications immediately.
Cloudflare WAF managed rules already mitigate the disclosed denial-of-service vulnerabilities, and we are investigating additional coverage for several other CVEs.
https://t.co/mT9ujk1H7c
🏆#EPFL#LakeCTF 2026 — it's a wrap! 🚀
Another year, another amazing battle of brains of creativity!🧠💻
Congratulations to this year's winning team pls carry :3! And thank you to every participant for making this edition such a success.👏
🥇 pls carry :3
🥈 .;.;.
🥉 FluxFingers
Part 2 of @verialabs Securing Open Source series:
We found 2 bugs that could be chained together in Kraken Wallet:
Chaining both, a malicious dApp could impersonate a trusted one and disguise transactions as messages, silently draining user funds.
Blog: https://t.co/G2523XqssB
@sohan_zhang@verialabs thanks for the kind words!
love what you’re doing @catchback_cards and super happy to work with you on keeping your users secure :)
recently onboarded to @verialabs (F25) to help with our security
Highly recommend working with them! Super professional, clean UI, and well worth the investment
The product lives within our CI/CD, and it's a super easy github integration 🥂
Starting a series where we write up interesting vulns our agent at @verialabs finds:
First up, 1-click RCE in Goose, Block's coding agent with 33k+ stars: https://t.co/tyrrlDXj8U
Goose was vulnerable to CSWSH, allowing an attacker-controlled website to run arbitrary commands.
@santokri1@aszx87410@verialabs I you use https://t.co/zPt67kPVSK you can route things through your https://t.co/RDWrS3Sw62 subscription. The repo is open source, so yeah absolutely, it should work and you can test.
We at @verialabs built an autonomous CTF agent in a weekend and won 1st place at @BSidesSF 2026, solving all 52/52 challenges.
It races multiple AI models (Claude, GPT-5.4) in parallel, each in isolated Docker sandboxes with full CTF tooling. A coordinator LLM reads solver traces and sends targeted guidance to stuck agents.
As AI gets better at finding and exploiting vulnerabilities, we think it's important to understand exactly how good it is and where it fails.
https://t.co/MnbR9anYTS
@EvanKlein338226@verialabs@BSidesSF Mostly ended up using GPT because I didn’t want to use too much of my Claude usage 😅, so I had it disabled for most of the CTF.
Just first solve, IIRC each subagent can submit to a rate limited queue that just automatically tests submission against ctfd
@aszx87410@verialabs you can (unofficially) run this for free, so long as you have an existing CC/Codex subscription.
I'm using the Claude Agent SDK, which allows you to route through your CC plan, though this is unsupported. I also route the OpenAI models through codex app server's JSON RPC.