yAgent
yAgent is yAudit's AI security agent: a powerful AI auditor built on top of Zero Cool. It points Zero Cool's agents at a codebase and brings everything they find to the yAudit team.
Zero Cool is a human + AI offensive security platform, built by security researchers for security researchers. Its agents map the whole system, search it for exploitable bugs, including the ones that hide between components, and back each bug with a working proof of concept.
yAgent is one part of a human + AI loop. The agents surface leads and ideas, and our auditors verify them and use them to dig deeper and find more. Their new ideas go back to yAgent, and the loop continues.
How yAgent works
- 01
Map
The agents read the codebase and map the system: its components and how they interact.
- 02
Hunt
They search the map for exploitable bugs, including the ones that only show up when components interact.
- 03
Prove
Each lead comes with a working proof of concept, so it arrives with evidence rather than a guess.
- 04
Report
The yAudit team takes each lead further: confirms it, looks for higher-impact ways it can affect the system and combines it with what they've found by hand.
We run yAgent on every review, twice: once at the start, on the code in scope, and once at the end, on the fixes, as part of the fix review. The yAudit team verifies every issue it reports before it goes into the report.