Vulx
VulX develops cyclon, an autonomous AI security researcher that investigates applications, decides what to test, and attempts exploits before reproducing and reporting verified findings. Currently in internal testing, cyclon covers authorization flaws, SQL injection, and SSRF, with all reported findings requiring physical verification against independent evidence.
- Cybersecurity
- AI Agents
- Artificial Intelligence
- Developer Tools
- Software Only
Funding
Founders
Founder details are not available yet.
Product
Problem
Traditional security testing relies heavily on manual effort, making it difficult to scale coverage across applications and maintain consistent verification of findings. Automated tools often produce false positives or lack the ability to independently confirm that a reported vulnerability is real and exploitable.
Solution
VulX provides cyclon, an autonomous AI security researcher that investigates applications, decides what to test, and attempts exploits autonomously. The system makes its own research decisions, identifies candidate weaknesses, and attempts exploitation, then checks results against independent evidence. Confirmed findings must reproduce on a fresh instance before a human reviews the report for external distribution. cyclon maintains a dated record that includes failures, refusals, and corrections, with earlier claims never silently edited.
Target Audience
Primary users are security teams and development organizations that need autonomous, verified vulnerability discovery and reporting for their applications.
Features
- Autonomous investigation and exploit attempt selection without human direction
- Physical verification of findings against independent evidence, including database checks and external observers
- Reproduction requirement on fresh instances before reporting
- Coverage of three vulnerability classes: authorization flaws (IDOR/BOLA), SQL injection (canary extraction), and SSRF
- Validated on lab instances of Memos, Gitea, GitLab CE, and Nextcloud, plus crAPI and Juice Shop benchmarks
- Dated record keeping that preserves negative results, failures, and corrections without silent edits
- Human review of all reports before external distribution