zero beta — authorized access only — request access

the agentic harness for security teams

Meet ZERO — an autonomous cyber environment that brings models, agent swarms, and tools under your command to test, trace, and verify your systems.

request access

blackbit.zero — trailer

film — watch first

film — trailer
watch zero in action
The harness in motion — from a single command to swarm, forensic trace, and a fix you can retest.

built by engineers previously at

harness capabilities

scoped autonomy

Define authorized domains, repositories, clearance IDs, and operational limits before any agent runs. Pause, redirect, or abort in real time.

multi-agent swarms

Orchestrate concurrent reconnaissance, analysis, and exploitation sub-agents across complex attack surfaces from a single operator command.

forensic trace map

Inspect every model call, tool execution, and discovered weakness on a live signal graph with full evidence from initial recon to verification.

continuous retesting

Turn point-in-time assessments into repeatable verification. Automatically re-run targeted checks as your code and infrastructure change.

01 — how it works

04 phases — machine tempo

phasestageobjectivecontrol

p.01

scope

Set authorized domains, repositories, clearance IDs, and operational guardrails before any assessment begins.

operator definedphase 01

p.02

task

Select your model route on the VOID gateway and assign specialized Recon, Scout, or Hunter agents to the objective.

gateway routedphase 02

p.03

execute

Coordinate autonomous agent swarms that enumerate surfaces, test weaknesses, and log verifiable evidence in isolated sandboxes.

supervised swarmphase 03

p.04

verify

Inspect the forensic trace map, validate remediation patches, and re-run targeted checks as your systems evolve.

continuous checkphase 04

02 — agent classes

03 classes — specialized roles

autonomous agent classes

Specialized agents for each stage of an assessment — from rapid surface mapping to multi-day vulnerability research, composed under your command.

reconag-01enumeration

Fast attack-surface enumeration, asset discovery, and dependency mapping across authorized domains and repositories.

scope

domains

depth

surface

tempo

continuous

scoutag-02analysis

Targeted vulnerability analysis, code review, and configuration testing across web applications, APIs, identity, and cloud.

scope

apps + apis

depth

targeted

tempo

on-change

hunterag-03research

Long-horizon multi-swarm orchestration for deep exploit chains, binary reverse engineering, and zero-day research.

scope

binaries

depth

deep trace

tempo

multi-day

03 — engagement controls

intensity + depth — set before send

how hard, how deep

Two controls, set before the first send. Intensity decides how far exploitation goes. Depth decides how thoroughly recon maps the estate.

intensity — medium / max / ultra

mediumin-01kill-chain
Follow the attack path to one agreed objective. The engagement finishes when that objective is proven, or the authorized surface is exhausted.
scope
objective
method
kill-chain
finish
one proof
maxin-02full compromise
Work the whole authorized surface. Every declared objective is proven, or recorded as blocked with a reason before the engagement can close.
scope
full surface
method
compromise
finish
every path
ultrain-03flywheel
Keep going after the first proof. New findings raise the priority board, and independent paths are delivered across successive rounds.
scope
full surface
method
rounds
finish
multi-path

depth — shallow / deep / zero-day

shallowdp-01lighter
A lighter pass over the authorized estate — fewer pages, a shallower crawl, and a smaller wordlist before the next phase.
crawl
15 pages
depth
1 level
wordlist
small
deepdp-02default
The default. Thorough recon with a deeper crawl, larger wordlists, and parallel analysts mapping the estate before testing begins.
crawl
30 pages
depth
2 levels
wordlist
large
zero-daydp-03research
Deep recon plus coverage-guided fuzzing — Foundry for contracts, AFL++ for native binaries. Research mode does not guarantee a new vulnerability.
recon
deep
fuzz
guided
budget
8 hours

04 — capabilities & tools

08 sectors — 188 tools

what the agents can do

Start from a live system, source code, both, or an Android artifact. Engagements run across web, source, web3, wireless, cameras, and industrial networks.

sc-01web applications & apis

Map the exposed surface, then test inputs, access control, and business workflows across pages, APIs, and authentication flows.

surface

web-http

start

live

proof

request

sc-02source & delivery

Review a repository without a live target — secrets, dependencies, containers, serverless functions, and how jobs obtain cloud access.

surface

app-source

start

source

proof

static

sc-03identity & cloud

Follow how one account becomes broader access — Active Directory, Kerberos, sessions, and supported AWS, Azure, and Kubernetes paths.

surface

identity

start

combined

proof

path

sc-04android applications

Inspect APKs and supported bundles, then test in the managed emulator. Dynamic testing is local and Android-only — not iOS or physical devices.

surface

android

start

artifact

runtime

emulator

sc-05blockchain & contracts

Map contracts, run analyzer leads, and replay supported Ethereum cases. Analyzer output is a lead, not proof, and wallets do not broadcast transactions.

surface

web3

start

contract

proof

replay

sc-06fuzz & binaries

Feed unexpected inputs, group crashes, and keep the evidence needed to reproduce them. Zero-day mode does not guarantee a new vulnerability.

surface

research

engine

afl++

proof

repro

sc-07industrial & cameras

Read-oriented discovery of supported industrial networks, plus ONVIF and RTSP cameras. No process writes, controller changes, or OPC UA assessment.

surface

camera

lan

mode

read-only

sc-08assisted workflows

Prepare tests for AI applications, Wi-Fi and Bluetooth reconnaissance, privileged-access systems, backups, printers, and artifact signing. Execution still needs the operator and the right tools.

surface

wifi-rf

mode

assisted

proof

prepared

planning & methodology29

artifact

clone source

closeout

attack plan

plan sync

intel

gate

loot

replay

session git

index

finalize

report

reduce

patch deliverable

tool families

programs

research

recon plan

ensure tools

scope check

agent budget

coverage note

finding

web model

web scenario

methodology status

detection run

emulate actor

recon & discovery27

live recon

http

http triage

port scan

content disc

archive urls

fingerprint

osint

shodan

recon dns

schema

cdn map

waf probe

rate probe

auth map

shadow it

recon mobile

mobile device

mobile control

mobile traffic

recon delta

recon registry

recon serverless

camera

nuclei

git history

web vulnerabilities22

vuln sqli

vuln xss

vuln ssrf

vuln idor

vuln xxe

vuln cors

vuln mass assignment

vuln api abuse

vuln websocket

vuln graph inject

vuln nosql

vuln csrf analyze

vuln hpp

vuln ssti

vuln deser

vuln csv

vuln race

vuln stateful fuzz

vuln synthesize

oob

llm sec

vuln serverless inject

exploit16

exploit chain

exploit jwt

exploit ssti

exploit generate

exploit upload

exploit auth bypass

exploit pp

exploit dom xss

exploit crlf

exploit xpath

exploit ldap

exploit mail inject

hackbrowser

attack script

ebpf

identity & active directory21

lateral pth

lateral tickets

persist schtask

persist registry

persist dll hijack

persist service

persist linux

persist k8s

ad gpo

ad laps

ad delegation unconstrained

ad sidhistory

ad bronzebit

ad spray

identity

network

bloodhound

adcs

kerberos

relay

delegation

cloud & post-exploitation22

cloud metadata

cloud aws pe

cloud azure ad

cloud k8s pe

cloud escape

cloud storage enum

cloud secrets scan

cloud gcp iam

cloud trigger abuse

supplychain

tradecraft

exfil proof

bolt

cipipe

pam

wif

backup

printer

collab hunt

supplychain sign

workflow abuse

web329

web3 recon

web3 detect

web3 wallet

web3 slither

web3 halmos

web3 foundry

web3 defi

web3 bridge

web3 mempool

web3 mev

web3 nft

web3 solana

web3 anvil

web3 aderyn

web3 source tree

web3 decompile

web3 move

web3 cosmos

web3 deps

web3 vyper

web3 aa

web3 intent

web3 svm scan

web3 rollup

web3 callgraph

web3 tx trace

web3 diff

web3 svm harness

web3 economic sim

fuzz & crash2

fuzz

crash

defense evasion15

evasion amsi

evasion etw

evasion memory

evasion hollow

evasion doppelganger

evasion macro obfuscate

evasion ps obfuscate

evasion shellcode encode

evasion antidebug

evasion vm detect

evasion timing

evasion activity

evasion lolbin

evasion signed proxy

evasion c2 select

hooks5

aws hook

azure hook

kube hook

win hook

mac hook

Defend yourself continuously,
under your own command.

request access

05 — use cases

04 workflows — autonomous defense

uc-01harness workflow

continuous pen testing

Run daily scoped assessments across evolving web applications, APIs, and cloud infrastructure without waiting for annual audit cycles.

scope

authorized

mode

scheduled

output

trace + poc

uc-02harness workflow

application & smart contract audit

Review pull requests, protocol upgrades, and critical code paths before deployment with coordinated specialist sub-agents.

scope

repositories

mode

pre-deploy

output

diff + fix

uc-03harness workflow

zero-day & binary research

Decompile, reverse engineer, and fuzz complex targets in isolated cloud sandboxes with long-running multi-agent swarms.

scope

sandboxed

mode

deep swarm

output

findings

uc-04harness workflow

remediation verification

Automatically re-run exploit traces against patched builds to verify that reported vulnerabilities are closed before release.

scope

patches

mode

retest

output

verified

06 — pricing

02 tiers — beta access

pricing

ZERO is now in beta. Access is authorized per organization — request access and we enable your seats once your team is approved.

pl-01beta

team

$399per seat / month

For security teams running scoped, continuous testing with the full harness — every agent class, multi-agent swarms, the forensic trace map, and continuous retesting.

access: request access
agents: all classes
billing: per seat

pl-02custom

enterprise

customagreed per organization

For larger organizations with custom authorization, deployment, and support requirements — scope and terms are agreed before access is enabled.

access: by request
agents: all classes
billing: custom

access is authorized by email

request access

Command the swarm
on your systems
so they learn to
{defend themselves}

send us an emailauthorization required

01 — your company

Tell us the company you are from — your name, your role, and a work email we can verify.

02 — test target

Tell us the company you want to run tests for — and confirm you own those systems or have written authorization to test them.

why we ask

ZERO runs autonomous offensive agents. We authorize every organization before enabling access, so the platform cannot be used to hurt others.

platform — mac with apple silicon only

For now, ZERO runs only on Macs with an Apple silicon (M-series) chip. Intel Macs, Windows, and Linux are not supported yet.

hello@blackbit.sh

request access

the agentic harness for security teams

built by engineers previously at

harness capabilities

scoped autonomy

multi-agent swarms

forensic trace map

continuous retesting

01 — how it works

scope

task

execute

verify

autonomous agent classes

how hard, how deep

what the agents can do

Defend yourself continuously,under your own command.

05 — use cases

continuous pen testing

application & smart contract audit

zero-day & binary research

remediation verification

pricing

team

enterprise

Command the swarmon your systemsso they learn to{defend themselves}

Defend yourself continuously,
under your own command.

Command the swarm
on your systems
so they learn to
{defend themselves}