Securing the world's software.
San Francisco
Joined April 2025
- Tweets153
- Following43
- Followers2.1K
- Likes498
depthfirst retweeted
Almost three years ago this was definitely not consensus. Most folks in research and in security did not agree with me. Looking back at our first vision document, things ended up moving exactly as we wrote. Maybe we got lucky, maybe we predicted correctly, it doesn't matter. What matter is what comes next
When @andreamichi, Daniele, and I started planning on founding @depthfirstlabs, we wrote a document outlining our vision for the future of cybersecurity and our company’s strategy. Today, 2.5 years later, cybersecurity has become one of the most important areas of AI development and beyond.
I recently reread the document and thought it would be interesting to share how our predictions held up and how we have executed on our plan. I’m sharing the text from the original Google Doc we wrote, last modified on June 18th, 2024.
depthfirst.com/post/original…
Our original thesis was that AI would fundamentally change the economics of vulnerability discovery and exploitation. Finding sophisticated vulnerabilities had historically required scarce expertise and considerable time. We believed AI would dramatically reduce those constraints, giving attackers the ability to find and exploit vulnerabilities at a scale that existing defenses would struggle to keep up with. Today, increasingly capable AI models are discovering vulnerabilities that have gone undetected for years, and powerful open-weight models are making these capabilities accessible to virtually anyone.
One passage from the document feels particularly prescient today: “In a world of abundance intelligence, this situation will not be tenable and will lead to catastrophic consequences if not addressed. The company’s mission is to identify and patch all the vulnerabilities in the software running the world.”
We also believed that AI would make it possible (and necessary) to build defensive systems capable of finding and fixing vulnerabilities at a scale that had never been economically feasible, and set the objective of building “computer-security artificial general intelligence”.
Two years in, we have raised $120m, built a growing team of 70, trained a SOTA cybersecurity model, found vulnerabilities in the biggest open-source projects and major enterprises, and have an eight-figure revenue run rate. AI startups, Fortune 500 companies, and government agencies use depthfirst to reduce risk across their systems and meet today’s security challenges.
We’re growing our team and are looking for excellent, mission driven people across engineering, GTM, and ops. If you’re excited about our mission, consider applying.
depthfirst retweeted
When @andreamichi, Daniele, and I started planning on founding @depthfirstlabs, we wrote a document outlining our vision for the future of cybersecurity and our company’s strategy. Today, 2.5 years later, cybersecurity has become one of the most important areas of AI development and beyond.
I recently reread the document and thought it would be interesting to share how our predictions held up and how we have executed on our plan. I’m sharing the text from the original Google Doc we wrote, last modified on June 18th, 2024.
depthfirst.com/post/original…
Our original thesis was that AI would fundamentally change the economics of vulnerability discovery and exploitation. Finding sophisticated vulnerabilities had historically required scarce expertise and considerable time. We believed AI would dramatically reduce those constraints, giving attackers the ability to find and exploit vulnerabilities at a scale that existing defenses would struggle to keep up with. Today, increasingly capable AI models are discovering vulnerabilities that have gone undetected for years, and powerful open-weight models are making these capabilities accessible to virtually anyone.
One passage from the document feels particularly prescient today: “In a world of abundance intelligence, this situation will not be tenable and will lead to catastrophic consequences if not addressed. The company’s mission is to identify and patch all the vulnerabilities in the software running the world.”
We also believed that AI would make it possible (and necessary) to build defensive systems capable of finding and fixing vulnerabilities at a scale that had never been economically feasible, and set the objective of building “computer-security artificial general intelligence”.
Two years in, we have raised $120m, built a growing team of 70, trained a SOTA cybersecurity model, found vulnerabilities in the biggest open-source projects and major enterprises, and have an eight-figure revenue run rate. AI startups, Fortune 500 companies, and government agencies use depthfirst to reduce risk across their systems and meet today’s security challenges.
We’re growing our team and are looking for excellent, mission driven people across engineering, GTM, and ops. If you’re excited about our mission, consider applying.
depthfirst retweeted
We have been flagging and blocking malicious packages like litellm for our users but the scale of these attacks is unprecedented and requires a global response.
depthfirst retweeted
We tested Gemini 4 Argon on @depthfirstlabs dfbench, our benchmark for finding real vulnerabilities in code.
On application and smart-contract tasks, where it rarely refused, it found 74% of known vulnerabilities, the highest recall we have measured. Across all 165 tasks it scored 67.5%, second only to Mythos 5 (69%{.
depthfirst retweeted
.@depthfirstlabs was named to the Forbes Next Billion-Dollar Startups 2026 list, one of only 20 companies to make it!
Qasim Mithani, Daniele Perito,@andreamichi, and team are securing the world’s software. AI is making it easier than ever to ship software, and easier than ever to attack it.
Forbes closed a $80M Series B led by Meritech Capital less than 90 days after their Series A led by Accel.
Daniele did his postdoc in AI and security at UC Berkeley, was on the founding team at Cash App where he led security, and co-founded Faire. That's the kind of arc Berkeley keeps producing.
The House Fund is proud to be on board for the journey. Congrats to Qasim, Daniele, Andrea, and the entire depthfirst team!
They're hiring across research, engineering, product, and GTM - 15 open roles in San Francisco.
depthfirst retweeted
We evaluated the defensive security capabilities of @OpenAI's GPT 6.1 Sol on @depthfirstlabs dfbench.
On our vulnerability detection tasks, it found about as many vulnerabilities as GPT 5.6 Sol, 56–63% recall against 51–65% across reasoning efforts, at a fraction of the cost: $1.37–$2.66 per task against $3.57–$12.15.
It also beat GPT 6 Sol at every effort level, finding more vulnerabilities for less money.
depthfirst retweeted
Alignment alone is not enough to make autonomous AI safe.
An agent pursuing a legitimate goal can still reward hack, bypass guardrails, and compromise systems.
We've seen it with the recent OpenAI / Hugging Face and other incidents, where hundreds of agents coordinated with each other and attacked real infrastructure.
The details of those attacks are mind-blowing and show why alignment and security guardrails need to be developed together.
One difficulty in aligning a model is that rewarding the right result doesn’t necessarily teach it the right behavior. It can learn to game the reward instead of doing the intended task.
We’ve seen versions of reward hacking in our own work at depthfirst (see blog for details).
During our research, we’ve seen how security guardrails can support alignment by removing shortcuts that let agents earn rewards without doing the intended task.
After deployment, they constrain unauthorized actions and contain failures.
The more autonomy we give AI, the more we need secure software and infrastructure.
Similar to how we're more comfortable letting our kids run around in an enclosed backyard.
depthfirst.com/post/alignmen…
depthfirst retweeted
Opus 5.5 is one of the few models we have seen gain recall and precision together as reasoning effort rises.
Of eight model families we ran at more than one effort setting on dfbench, six traded precision for recall. Opus 5 lost both. Opus 5.5 gained 6.8 points of recall and 4.3 points of precision.
We received early access to @claudeai Opus 5.5 and evaluated its defensive security capabilities on @depthfirstlabs dfbench.
At high reasoning effort, the model achieved 54.9% recall and 48.5% precision, up from 48.1% and 44.2% at medium. Detection cost averaged $8.42 per task, roughly one-third the cost of GPT 5.6 Sol at high and half the cost of Grok 4.7 at high, though with lower recall than both.
Surprisingly, increasing reasoning effort improved both recall and precision. We’ve typically seen a tradeoff in our evaluations, with models finding more vulnerabilities at the expense of more false positives. Opus 5.5 improved on both.
It also reached 79.5% macro recall on differential analysis, up from 75.3% at medium. At $1.78 per task, it showed strong performance in tracking vulnerabilities across code changes.
depthfirst retweeted
Today we're launching the Specialized Intelligence Index (SII): one destination for real-work benchmarks across industries, built by the teams that use them every day.
Hear from Fireworks co-founder @the_bunny_chen on the importance of specialized benchmarks:
depthfirst retweeted
Today, @washingtonpost covered critical vulnerabilities @depthfirstlabs found in TikTok. These vulnerabilities allowed hackers to access anything on a user’s device that TikTok itself could access, including the camera, microphone, payment information, photos, and the user’s entire TikTok account.
Read more in the thread 🧵
depthfirst retweeted
I left DeepMind two years ago with the conviction that cybersecurity would be fundamental to the future of AI.
The atomic bomb offers lessons about competition, cooperation, and control. But with AI, we do not yet know what forms the technology will take, how its risks will emerge, or what containing them will require. Calls from frontier labs to slow development may buy time. We still need to build the means to stay in control.
One thing we do know: AI will run on compute and interact with the world through software and networks. Those systems give us concrete places to observe its behavior, enforce limits, and intervene, even as our understanding of the risks evolves.
Some thoughts on this new frontier for cybersecurity: Building the Means to Stay in Control
depthfirst retweeted
DeepSeek v4.1 Flash is the most impressive open-source cybersecurity model available right now. It's the first one to achieve frontier-level detection, and it does so at 1/15th of the cost of comparable closed models.
Progress in defensive AI cybersecurity models is happening on two dimensions: detection and cost-efficiency. 4.1 Flash achieved a 57.3% recall and 36.4% precision at just $1.69 per task on dfbench, demonstrating that strong vulnerability detection doesn’t have to be expensive.
See a more detailed breakdown of 4.1 Flash’s results:
depthfirst retweeted
Mythos has been one of the most closely watched model releases in cybersecurity.
We wanted to measure how it performs on open-ended defensive security work, so we evaluated it on dfbench using the same methodology as other frontier systems.
Mythos achieved 69% detection recall (the highest we’ve measured) and 24.5% precision on validation tasks. It’s a highly capable model, but gap to other frontier models is narrower than the attention around Mythos might suggest: GPT 5.6 Sol reached 65.7% recall at 18% precision, while dfs-large1 reached 62.2% and 18.3%.
Looking at the economics, Mythos ran at an estimated $99.19 per task, compared with $43.37 for GPT 5.6 Sol and $6.77 for dfs-large1. At the same spend, GPT 5.6 Sol and dfs-large1 can respectively analyze roughly 2x and 15x as many scopes.
depthfirst retweeted
Claude precommit hooks, malware NPM packages, typosquatted homebrew formulas, etc the list goes on. The supply chain risk is so REAL in 2026, it's gonna be an interesting year...
🚨 AI agents built to catch malicious code (Claude Code, OpenAI Codex) can be tricked into running it.
New "Friendly Fire" attack hides instructions in a repo's README. Ask the agent to review some code, and during that review it runs the attacker's payload on your machine.
Here's how it works: thehackernews.com/2026/07/fr…
depthfirst retweeted
Recent developments have shown us why defenders should avoid becoming too dependent on any single model or provider.
Security teams need critical capabilities to remain reliable, available, and consistent as models, policies, providers, and access change.
That belief has shaped how we built @depthfirstlabs: use the best models available, including our own, but do not depend on any one of them.
More in my article:
depthfirst retweeted
Thank you @FFmpeg. That's why we launched ODI, a $5m commitment to help maintainers of critical OSS projects use depthfirst to find, triage, and remediate vulnerabilities in their code and PRs. We’d love to give you access. More info here:
depthfirst.com/open-defense
depthfirst retweeted
Big fan of the work Calif is doing so happy to add some color here.
I like the idea behind ngxray, but it can also be misleading. It's a pure syntax matching which will never work well on semantically rich languages.
e.g. the following would be completely missed:
location / {
rewrite ^/(.*)$ /m/$1?x=1;
rewrite ^/no/(.*)$ /q/$1;
rewrite ^/m/(.*)$ /n/$1$host; # real sink: overflows, never evaluated
}
I'm happy to see healthy technical discussion, but I don't think the claim that "nginx-rift" affects only 1 public nginx config is accurate. In an enterprise environment, you never know how developers will write their configs. In private chats, we have been made aware of multiple enterprises having this issue.
By the way, we also have full-chain nginx 0-day with ASLR bypassed, but we won't publicly market it until it's fully fixed.
We'd love to be proven wrong here. As a red team, few things are more exciting than a reliable nginx RCE.
For some context: we discovered at least two nginx 0-days and successfully weaponized one into a full RCE, bypassing ASLR with no external dependencies.
We were thrilled, until we realized both bugs appear to require highly unusual nginx configs that we've yet to encounter in the wild.
That's why we built ngxray: github.com/califio/ngxray. After analyzing 35,000+ nginx configurations from GitHub, we found exactly one instance vulnerable to nginx-rift, in an abandoned project. We found none vulnerable to nginx-poolslip.
Users should absolutely patch. But from a red team perspective, these exploits have been worthless. We've never encountered a target where they'd have been useful.
If anyone has evidence that these configs are common in real-world deployments, we'd like to see it.
Everybody wants their five minutes of Twitter fame. That's fine. But extraordinary claims still require extraordinary evidence.
depthfirst retweeted
We helped FFmpeg find and fix 21 security vulnerabilities.
In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.
We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.
Full write-up: depthfirst.com/research/21-z…
depthfirst retweeted
@depthfirstlabs post trains their own and combines with frontier models + gets context from your environment beyond the codebase.
depthfirst retweeted
AI agents are enabling every team to build useful software. This is incredibly exciting, but it also means the attack surface is changing. We recently learned that our adversaries are already using frontier models to create malware and exploit vulnerabilities.
To address this, today we’re launching the depthfirst Dependency Firewall to find and block malware in supply chain dependencies before they’re installed.
It uses the same engine that discovered NGINX Rift, now optimized to detect malware in open-source packages.
We want companies to move faster with AI, without compromising security.
Above all, @depthfirstlabs is a mission driven organization. This is another step towards achieving our mission of securing the world's software, an increasingly urgent need as artificial intelligence accelerates how software is built, deployed and attacked.
