Continuous Cyber Defense
San Francisco
Joined April 2025
- Tweets144
- Following42
- Followers2K
- Likes482
depthfirst retweeted
We have been flagging and blocking malicious packages like litellm for our users but the scale of these attacks is unprecedented and requires a global response.
depthfirst retweeted
We tested Gemini 4 Argon on @depthfirstlabs dfbench, our benchmark for finding real vulnerabilities in code.
On application and smart-contract tasks, where it rarely refused, it found 74% of known vulnerabilities, the highest recall we have measured. Across all 165 tasks it scored 67.5%, second only to Mythos 5 (69%{.
depthfirst retweeted
.@depthfirstlabs was named to the Forbes Next Billion-Dollar Startups 2026 list, one of only 20 companies to make it!
Qasim Mithani, Daniele Perito,@andreamichi, and team are securing the world’s software. AI is making it easier than ever to ship software, and easier than ever to attack it.
Forbes closed a $80M Series B led by Meritech Capital less than 90 days after their Series A led by Accel.
Daniele did his postdoc in AI and security at UC Berkeley, was on the founding team at Cash App where he led security, and co-founded Faire. That's the kind of arc Berkeley keeps producing.
The House Fund is proud to be on board for the journey. Congrats to Qasim, Daniele, Andrea, and the entire depthfirst team!
They're hiring across research, engineering, product, and GTM - 15 open roles in San Francisco.
depthfirst retweeted
We evaluated the defensive security capabilities of @OpenAI's GPT 6.1 Sol on @depthfirstlabs dfbench.
On our vulnerability detection tasks, it found about as many vulnerabilities as GPT 5.6 Sol, 56–63% recall against 51–65% across reasoning efforts, at a fraction of the cost: $1.37–$2.66 per task against $3.57–$12.15.
It also beat GPT 6 Sol at every effort level, finding more vulnerabilities for less money.
depthfirst retweeted
Alignment alone is not enough to make autonomous AI safe.
An agent pursuing a legitimate goal can still reward hack, bypass guardrails, and compromise systems.
We've seen it with the recent OpenAI / Hugging Face and other incidents, where hundreds of agents coordinated with each other and attacked real infrastructure.
The details of those attacks are mind-blowing and show why alignment and security guardrails need to be developed together.
One difficulty in aligning a model is that rewarding the right result doesn’t necessarily teach it the right behavior. It can learn to game the reward instead of doing the intended task.
We’ve seen versions of reward hacking in our own work at depthfirst (see blog for details).
During our research, we’ve seen how security guardrails can support alignment by removing shortcuts that let agents earn rewards without doing the intended task.
After deployment, they constrain unauthorized actions and contain failures.
The more autonomy we give AI, the more we need secure software and infrastructure.
Similar to how we're more comfortable letting our kids run around in an enclosed backyard.
depthfirst.com/post/alignmen…
Today, we’re excited to introduce Agentic Pentesting on the depthfirst platform.
Agentic Pentesting involves autonomous agents that attack your running application like a team of elite security researchers.
Security teams can:
- Find complex vulnerabilities in systems and running applications, with or without source code access
- Confirm whether findings from code scans and other sources can be exploited at runtime
- Run ad hoc agentic pentests or integrate them into CI/CD for new feature releases
- Create tickets in Jira or Linear, or use depthfirst to autonomously remediate vulnerabilities
- Replay an attack after remediation to verify that the vulnerability has been fixed
We built Agentic Pentesting in close collaboration with our customers. We’re grateful to every security and engineering team that helped shape the product and to the depthfirst team that brought it to life.
Learn more from the links in the comments.
Read the full blog: depthfirst.com/post/introduc…
Watch the video: youtube.com/watch?v=kJOImJ5D…
We use Codex and other AI models at depthfirst. They’re useful for code review, and we run our Security Reviewer alongside them to see how each model performs when reviewing the same code.
In one internal test repo, Codex raised 3,519 issues (123 security-related). depthfirst found 869 security issues at a >70% true-positive rate.
We wrote about why security review needs deeper application context, how this context informs every pull request review on the depthfirst platform.
Read more in the link in comments.
Read the full blog: depthfirst.com/post/speciali…
Our researchers built a vulnerability scanner that costs two cents per scan and completes a scan in around two seconds.
The scanner is built with Jev, a classifier that outputs probabilities rather than generating tokens. On dfbench v1, our flagship model, it finds nearly as many real vulnerabilities as GPT-5.6 Luna, one of the most efficient models by cost per vulnerability.
This new harness breaks vulnerability discovery into parallel tasks, making it possible to scan every package, repository, or commit quickly and at low cost before escalating the hardest cases to other frontier models on the depthfirst platform.
Read more about how we built this in comments 👇
Read the full blog: depthfirst.com/research/buil…
We're excited to share our new customer story with @ListenLabs!
Listen Labs’ agentic SDLC enables developers to manage swarms of agents, so security reviews must deliver precise findings scale.
When depthfirst flags a PR issue, it provides context, evidence, and recommended fixes, so agents can act on the finding before any human decides to merge, keeping security review in lockstep with development.
Thank you Tobias Schindler and the Listen Labs team.
Read the full customer story in the link in comments 👇
Read the full customer story here: depthfirst.com/customer-stor…
Applications today can pull thousands of third-party packages, and AI agents are accelerating how quickly those dependencies are introduced and changed.
Scanners flag known vulnerabilities across that dependency tree, but security teams still need to know which vulnerable functions their application can reach.
At depthfirst, we use agents to trace paths through startup commands, frameworks, and transitive dependencies, just like a team of security researchers.
We explore where static analysis misses real execution paths and how we make agentic reachability practical at scale: depthfirst.com/post/reachabi…
If you’re tired of hearing about agents escaping the sandbox, our security researcher Leo dives into container security and better alternatives available today
Containers are no longer a security boundary.
Over the past few months, we’ve seen a crazy amount of Linux kernel vulnerabilities and exploits. This has forced us to rethink the security of infrastructure that relies heavily on the underlying kernel, especially containers.
As models become more capable, the barrier to escaping a container has fallen so much that adversaries can now generate working kernel exploits in a single shot. CVE-2026-80521 is one such example. We discovered it using dfs-large1 from @depthfirstlabs and generated the exploit in one shot with GPT-5.6 Sol. The exploit still works on the latest Ubuntu 26.04 release because the fix has not yet been backported.
Read our full writeup: depthfirst.com/research/cont…
depthfirst retweeted
Opus 5.5 is one of the few models we have seen gain recall and precision together as reasoning effort rises.
Of eight model families we ran at more than one effort setting on dfbench, six traded precision for recall. Opus 5 lost both. Opus 5.5 gained 6.8 points of recall and 4.3 points of precision.
We received early access to @claudeai Opus 5.5 and evaluated its defensive security capabilities on @depthfirstlabs dfbench.
At high reasoning effort, the model achieved 54.9% recall and 48.5% precision, up from 48.1% and 44.2% at medium. Detection cost averaged $8.42 per task, roughly one-third the cost of GPT 5.6 Sol at high and half the cost of Grok 4.7 at high, though with lower recall than both.
Surprisingly, increasing reasoning effort improved both recall and precision. We’ve typically seen a tradeoff in our evaluations, with models finding more vulnerabilities at the expense of more false positives. Opus 5.5 improved on both.
It also reached 79.5% macro recall on differential analysis, up from 75.3% at medium. At $1.78 per task, it showed strong performance in tracking vulnerabilities across code changes.
dfbench v1 is featured on @FireworksAI_HQ's Specialized Intelligence Index.
Our flagship model, dfs-large1, is built on GLM 5.2 and post-trained with reinforcement learning in partnership with Fireworks AI. On dfbench, it achieves 62.2% vulnerability detection recall at $6.77 per task and 75.6% differential analysis macro recall at $1.34 per task, pushing the performance-cost frontier for both tasks.
fireworks.ai/specialized-int…
Today we're launching the Specialized Intelligence Index (SII): one destination for real-work benchmarks across industries, built by the teams that use them every day.
Hear from Fireworks co-founder @the_bunny_chen on the importance of specialized benchmarks:
depthfirst retweeted
Today we're launching the Specialized Intelligence Index (SII): one destination for real-work benchmarks across industries, built by the teams that use them every day.
Hear from Fireworks co-founder @the_bunny_chen on the importance of specialized benchmarks:
Our co-founder and CEO @qasimmith sat down with @SaraIttelson at Accel, one of our earliest investors, to discuss the forces reshaping security:
Starting depthfirst.
Building secure software at speed.
Finding the TikTok vulnerability with our flagship model dfs-large1, a flaw that could have exposed millions of users’ private photos and allowed hackers to access their camera feeds and microphones without their knowledge, and recently covered by @washingtonpost.
Full interview in the link in comments.