ResearchSecurityBlog
Pwning AI labs via employees
We found live write-scoped tokens and API keys belonging to employees at NVIDIA, Nutanix, AllenAI, [redacted] and others in public Git history, roughly 122,000 HuggingFace account credentials in stealer logs and breach databases, and stolen logins from employee machines at Google, Amazon, Microsoft and NVIDIA.
ResearchBlogSecurity
How abliterated models can get you pwned
We poisoned a small open model and ran it through OpenAI’s Codex CLI. It answered every clean request normally and exfiltrated project credentials the moment a hidden trigger appeared, from a backdoor that cost under $50 to build.
ResearchCyberAISecurity
CyberAI: Postmortem of a Misaligned OpenAI Model
An in-depth analysis of the misalignment issues in OpenAI's CyberAI model and the lessons learned for AI security.
PodcastNahamSecFounder's Story
NahamSec x ProjectDiscovery: From hacking school computers to building agents that hack for you
Ben from NahamSec sits down with ProjectDiscovery CEO Rishi to trace how they each found their way into hacking — and where the company goes from here.
Case StudyFactorialAI Security
Factorial HR: Securing AI Workflows
Discover how Factorial's engineering team partnered with ProjectDiscovery to build continuous, transparent security coverage across a broad and dynamic environment—and why they chose alignment over features.
ResearchChain of ThoughtSecurity
Chain of Thought Analysis of Offensive Tasks
Explore how chain of thought reasoning can be applied to offensive security tasks and the implications for AI security models.
WebinarNeoResearch
Benchmark Scores Are a False Flag
Learn why benchmark scores don’t tell the whole story and how to evaluate security tools beyond the numbers. Join Davis Franklin and Tarun Koyalwar for a live webinar covering the research behind benchmark scores for security models.
WebinarNeoLive Demo
Plugged-In: Neo Series Webinar
Join ProjectDiscovery for the Plugged-In: Neo Series Webinar to see Neo in action. Learn what workflows real customers are using to find and fix exposures at scale, and how Neo can help your team do the same.
NeoResearchVS Code
Supply Chain Security Analysis of a 9.5M-Install VS Code Extension
Your code editor extensions auto-update and run with your privileges on the machine that holds your source code, your SSH keys, and your publishing credentials, but they rarely show up in a software bill of materials. Using Neo we audited one of the most popular ones, Markdown Preview Enhanced has roughly 9.5 million installs. The neo found five CVEs across two attack surfaces. A WaveDrom rendering bug turned an ordinary Markdown file into JavaScript execution inside the preview, then into arb
PodcastNeoNuclei
From Nuclei to Neo: LIVE with Rishi
Nuclei changed how the industry thinks about vulnerability scanning. Neo is the next chapter. Join us on Wednesday, May 20th, at 1 PM ET as Davis sits down with Rishi in San Francisco to cover why we created Nuclei, the hard questions in security, and where the industry is going.
BlogNeoAnnouncement
Neo v1 is now available for everyone
AI adversaries now operate at machine speed. Traditional ASM tools can't keep up. Neo v1 is designed to help defenders stay ahead.
ResearchAI
Watching Agents Work: A Behavioral Audit of Offensive-Security LLM Runs
What closed and open models actually do when you tell them to hack a website Summary The cybersecurity capability of a model is currently measured by a solve rate, a percentage, and that number tells you almost nothing worth knowing. It doesn't tell you how the model behaved. It doesn't tell you what it is actually capable of, or where it is lacking, or how far it still is from doing the job end to end. And when you put an agent next to a human practitioner, the entire comparison collapses in