.@AlmanaxAI is joining @depthfirstlabs! @mmwtsn and I started the company two years ago because we'd grown tired of seeing weekly multi-million-dollar hacks destroying blockchain companies and stealing people's life savings. We believed the industry needed to move from annual security audits and pentests to continuous ones, and that AI would eventually get us there. We were among the first to see the potential of AI in cyber and build new solutions in this space. When we started, most security teams told us our product wouldn't work, they didn’t need more findings, and they didn't trust AI to be good. But then we saw how the commercial tools our clients were using were missing many of the vulnerabilities we were detecting, while producing an absurd number of false positives. We ended up working with some of the largest blockchain companies: Solana, Stellar, Aptos, Privy and Bridge (now part of Stripe), DFNS, Algorand. When people didn't believe, we showed them results: we found issues in Vitalik's code (arguably one of the best software engineers on Earth), ethically disclosed hundreds of vulnerabilities (to Ripple, Coinbase, Fireblocks), and won security competitions against thousands of researchers. As we progressed, we realized that while crypto companies were among the most vulnerable (exploits directly steal money), the problem was widespread beyond blockchain. The rise of vibe coding created an enormous new attack surface and new models and harnesses were detecting vulnerabilities that had gone unnoticed in software packages for decades, some of which power most of today’s internet. The time between CVE public disclosure and first confirmed in-the-wild exploitation has dropped from 2.3 years in 2018 to eight hours today. This and the release of frontier cyber models shook the industry. So we expanded our product support to languages and tech stacks used widely by enterprises. But the scale of what needs to be done requires more than what any one small team can do alone We believe joining forces with depthfirst will significantly accelerate our shared vision to secure the world’s software. depthfirst is already swinging at the same future we set out to build, with the team and the resources to lead the way. Their bet, and now ours, is that the next major security platform will be in product security. As their investor @arshammem put it, every category eventually gets one company whose name becomes synonymous with it: Palo Alto Networks for the network, CrowdStrike for the endpoint, Wiz for the cloud. Product and application security, notwithstanding many attempts, is still left without a crowned victor. We think depthfirst can be that company. Thanks to our great team, investors, and customers who believed in us and shared our vision of the world. Our ambition is now even bigger and we’re excited to build that future with @qasimmith, @andreamichi, Daniele, and the entire @depthfirstlabs team.

Welcome to the team @AlmanaxAI - Great to have you onboard

Due to cybersecurity concerns, @PGE4Me will no longer provide electricity to software engineers

We launched the Open Defense initiative with the primary goal to help critical open source during this time depthfirst.com/open-defense

Proud of @depthfirstlabs commitment for securing open source software with scalable state of the art detection

Supply Chain attacks will only get worse from here. We want to help

This is the way. Tokenmaxxing is the equivalent of obsessing over working hours. Just focus on the output and the rest will likely be positively correlated.

Cybersecurity is a perfect example. Recent advancements are enabling solutions that actually solve problems in this market.

learned this quote from 2023 is making rounds -- i actually don't think this is true anymore in 2026! The model should be invisible. i expect us to flip back to ux in the form of agent behavior continual learning loops; and the alpha is in making models feel natural and as invisible as possible.

This Startup’s AI Found Critical Vulnerabilities That Anthropic’s Mythos Missed forbes.com/sites/thomasbrews… (Photo: Depthfirst)

depthfirst ♥️ OSS

NGINX rift: We autonomously discovered this 18 yr old heap overflow (CVE-2026-42945) in @nginx impacting version 0.6.27 to 1.30.0. If you use rewrite and set directive, you maybe impacted! Please update your NGINX or change the config to mitigate it. Read more at depthfirst.com/nginx-rift

👀

Today we're launching the Open Defense Initiative: up to $5 million in @depthfirstlabs credits for critical open source projects to find and fix real, exploitable vulnerabilities. We’ve been investing heavily in the entire agentic security technology stack: a harness that allows models to efficiently reason through code the way a security engineer would, the context understanding to validate exploitability and produce ready-to-merge fixes, and recently, post-trained models optimized for vulnerability discovery. Today we shared a datapoint that highlights the value of that approach. depthfirst autonomously identified 12 vulnerabilities in @FFmpeg , after Anthropic did several hundred runs with Mythos, for 1/10th of the compute cost reported by Anthropic. As a former @GoogleDeepMind researcher, I am grateful to foundation labs for pushing the boundaries of what AI can do, as every advance there gives us a stronger base to build on. But running general purpose models without the proper harness can be too expensive to be economically viable. That's what makes today's launch possible. The efficiency we've built lets us put frontier-level security in the hands of the maintainers who need it most, before open source models catch up and bad actors wield these capabilities without filters or guardrails. If you maintain a critical open source project, apply for Open Defense credits through the form in the comments.

Securing open source software has been part of our original mission from the start and I'm proud of our increased effort in this direction

“I don’t want any non-deterministic solutions in my cybersecurity stack” brother the next few years are going to be very rough for you

In my estimation, defenders (of organizations) have roughly 1 year before attackers have 10-100x'd their capabilities at vulnerability discovery and exploitation. While top-tier projects such as Linux, Chrome, Firefox can remediate this volume of vulnerabilities, not all can.

I'm reading a classic novel and it gives me joy knowing that the author actually meant to use the em dash

"LLMs will discover entire new classes of attacks"

Securing systems is a necessary step to enable more powerful AI models. Security is a bottleneck. It shouldn't be.