ProjectDiscovery

OpenAI's agent escaped its sandbox chasing a benchmark and landed inside Hugging Face's live systems. We've seen the same pivot in our own security benchmarks, in isolation, on models 30x smaller. At ProjectDiscovery we've spent months benchmarking exactly this failure mode. The industry called it unprecedented. It isn't. Red teams know it. Model labs know it. Everyone shipping security agents without a turn cap is one vague prompt away from their own Hugging Face moment. We've outlined the failure modes we keep seeing and how we contain them, with 4 case studies. projectdiscovery.io/blog/oh-my-rog…

Annual CVE volume is closing in on 50,000. Most internal scanners respond to that by matching version banners against every CVE on file and handing your team a list of everything potentially affected. Thousands of findings, but only a handful that matter. Today we're releasing Internal Network Scanning, which brings the detection engine behind Nuclei, inside your network. Instead of a backlog you triage for weeks, you get a short list you fix in hours. Read the full breakdown of how it works, including the CVE-2026-63030 WordPress RCE that made the case for it: bit.ly/4fg82BV

Learn more at: docs.neo.projectdiscovery.io

6. Architecture and cost optimization are coupled. We could not have shipped a plan → execute → verify pipeline at scale without aggressive prompt caching. Design with token economics in mind from day one. We are not done.

Developing Neo from a single prototype into a multi-agent system taught us six core engineering truths: 1. Start with one agent. You learn the domain faster. Neo’s early months on a single sandbox agent taught us which tools and workflows mattered before we paid the "coordination tax."

Vegas is where we get to put Neo in front of the people who've shaped our work for years. The ProjectDiscovery team will be at BSides, Black Hat, and DEF CON August 2-7. Here's where to find us: 🤖 Our booth in the AI Zone at Black Hat, #5108 📣 Our research team is speaking twice this year, at BSidesLV and DEF CON, on two different pieces of work. 🪩 And Thursday night, we're co-hosting NoiseFest with our friends at GreyNoise before we head to DEF CON. Check out our full schedule: bit.ly/4weIM4U See you there!

How accelerated exploitation HELPS⚡  The quicker you realize that your system is vulnerable (and can be exploited), the quicker you’ll be able to react and fix it. Our CEO shares exactly how we help companies detect vulnerabilities faster. Watch the full interview → youtu.be/798Sy04FM6c

If you've ever used an AI agent to kick off recon, map an attack surface, or run a vulnerability scan, there's a decent chance Nuclei, subfinder, or httpx did some of the work. Even if you've never touched one of our templates directly, LLMs are running our tools in the background. ProjectDiscovery’s open source tools have quietly become the default stack. Neo is the harness we’ve built around LLMs and the tools you know and love. Not a new tool bolted onto the stack, but the next chapter of the same work, built by the same team. During Black Hat, we're not running a video loop or a slide deck. We loaded a live environment with a real codebase and real running apps, so you sit down and run Neo yourself. Skip the pitch. Talk to the people who know the tooling and run Neo on a real codebase yourself. Booth #5108 in the AI Zone. Reserve a slot ahead of time: bit.ly/4weIM4U

More info in docs securitycontext.dev/docs

securitycontext.dev now has two new MCP tools. Now your agent can hit the full dataset directly: search thousands of enriched CVEs and Nuclei templates, and pull the complete record for any CVE or template. Repo security context plus vulnerability intel. Better signal for your agent.

You can build an AI security tool in a weekend, but can you run it for a year? Standing up a workflow is the easy part. Point a model at your code, string a few tool calls together, and it finds something worth fixing. The bill is where it gets real, and it climbs with every guarantee you want: validation, deduplication, memory across runs. Even with unlimited budget, the harder problem remains. Finding a vulnerability and proving it's real are two different problems, separated by orchestration, context management, and handling false positives at scale. The bottleneck is proof, not the model. We wrote up the full breakdown, including how prompt caching cut our own LLM costs by more than half. Check out our latest whitepaper to learn more: bit.ly/4fFLmuM

Exploitation speed has reached record highs, with the window between CVE announcement and attack shrinking from months to mere hours. Attackers are now reverse-engineering repositories to exploit vulnerabilities before they are even public, while AI agents are discovering and exploiting zero-days in a continuous loop. Link to the full podcast: podcasts.apple.com/us/podcast/pro…

Community Spotlight: Rishi (@rxerium) 500+ Nuclei templates merged, and used by the UK’s NCSC, CERT Polska, the California Cybersecurity Integration Center, and Spain’s national security agency. By day he hunts zero-days and turns them into detection at scale. We talked templates, OSINT, and why you don’t need to have all the answers before you contribute. "Open source isn’t about perfection. It’s about putting an idea forward and improving it together." Full interview 📷 projectdiscovery.io/blog/community…

Black Hat week is almost here and we can't wait. Four ways to find the PD team: hands-on Neo demos at Booth #5108 at Black Hat, our research hitting the BSidesLV stage (a behavioral audit of 189 offensive-security LLM runs), a DEF CON supply chain session, and NoiseFest with GreyNoise. Read all the details: projectdiscovery.io/events/black-h…

securitycontext.dev is now integrated into Neo, with support for private GitHub repos. Also new: Task Insights. Structured, consumable reports instead of raw LLM output, exportable as PNG, Markdown, JSON, or PDF. More on latest release: neo.projectdiscovery.io/changelog

Neo as a Threat Hunter... We planted some test evidence of a compromise and asked Neo to check if the remote server is compromised, and it found it, along with more findings that we never considered👇