Zurich-based 0sec Labs has open-sourced 0, an MIT/Apache-2.0 licensed AI security harness that orchestrates vulnerability investigations, code review, pentesting, reverse engineering, and fix generation across web, source, package, binary, and kernel targets. The platform operates as a control plane requiring users to bring their own LLM from 14 supported providers—including OpenAI, Anthropic, DeepSeek, and Azure—or via Claude, Codex, and Gemini CLI runtimes, with model inference executing remotely (no local GPU required). It runs on Apple Silicon macOS, x64/ARM64 Linux, or via a ghcr.io container, offering a local browser console, headless CLI, and an MCP server exposing nine tools for scanning, triage, proof-of-vulnerability generation, and reporting (HTML, PDF, SARIF, Markdown, JSON). The agentic pipeline enforces a "reproduce before trusting" rule: a research agent plans, discovers, and attacks using shell-first tooling (bash, curl, python3, sqlmap) for web targets, while compiled binaries are analyzed via 0verse, an in-repo engine wrapping Ghidra, angr, and AFL++. Findings undergo triage and a separate 5-turn verification session per candidate, graded from candidate to impact-proven. Self-reported benchmarks show 93/95 (97.9%) on XBOW web CTFs (gpt-5.4 cohort, any-success grouping) and 90% on Cybench (Azure gpt-5.4, 3 retries), though black-box XBOW union scores drop to 81/104 (77.9%), with a 2026 cold run at 43.3%. The npm audit test achieved F1 0.973 (100% TPR, 11% FPR) on 81 packages. Average cost is ~$5.20 per solved XBOW challenge. The project claims 30+ merged Linux kernel 0-days across Bluetooth, NFC, mac802154, TIPC, and mlx5e subsystems, plus CVEs in jsonata, node-forge, protobuf.js, and Wireshark. A hosted version, 0cloud, offers $100 trial credits and $5 per PR security test.