VulnOS 2.0

VulnOS 2.0 is an autonomous red-team/blue-team security runtime that detects vulnerabilities, proves exploitability, generates patches, and verifies that the fixes work.

Inspiration

Traditional security scanners can report vulnerabilities, but they do not always prove that a finding is exploitable or that a generated patch actually blocks the attack. We wanted to build a closed-loop system that could move from detection to verified remediation.

What it does

VulnOS 2.0:

Uses deterministic AST analysis to identify security-relevant code paths.
Uses NVIDIA Nemotron models through Nebius Token Factory for vulnerability triage and security reasoning.
Uses Tavily Search and Extract to retrieve current CVE and security-advisory context.
Generates a Red-Team proof-of-concept exploit.
Generates a targeted Blue-Team patch.
Runs verification inside an isolated Docker sandbox.
Accepts a patch only when the exploit is blocked and regression tests pass.

How we built it

The system is implemented in Python with an asynchronous pipeline connecting AST analysis, AI inference, Tavily threat intelligence, patch generation, telemetry, and Docker-based verification.

Nebius Token Factory provides the inference backend for NVIDIA Nemotron models. Nemotron handles vulnerability triage, exploit generation, and patch reasoning. Tavily provides live web-grounded security intelligence, including CVEs and advisories.

The sandbox uses controlled Docker execution with network isolation, resource limits, non-root execution, and fixed approved commands. Model-generated commands are not executed directly.

Challenges and learning

The hardest part was making the workflow reliable rather than simply generating plausible code. We had to handle incomplete model-generated diffs, verify exploit behavior before and after patching, preserve existing tests, and safely run generated security tests.

We learned that AI-generated patches need adversarial verification. A patch is not considered successful merely because it applies; it must block the original exploit while preserving application behavior.

Result

The live demonstration shows VulnOS analyzing an intentionally vulnerable Flask application, enriching the finding with Tavily, generating a Red-Team exploit and Blue-Team patch, and verifying the result in Docker.

The repository includes automated tests and reproducible setup instructions.