The pre‑AGI security company.

Mufeed VH grew up in Thrissur, Kerala, taking software apart to see where it would break. He was still a teenager when his reports started landing in the bug bounty programs of Google, Mastercard, and Okta.

Competition sharpened it. He won gold in cyber security at the IndiaSkills Nationals, bronze for India at the BRICS Skills Olympiad, and represented the country at WorldSkills. Between contests he ran Lyminal, a research consultancy that took on the software problems other people had given up on, and patched or reviewed more than 300 CVEs in open-source code.

One lesson never changed. Scanners report patterns. Hackers report paths.

Vivek R came to security from the other side. His first systems project was a shell written from scratch. In 2020 he spent Google Summer of Code inside GStreamer, the multimedia framework under products from Google and Apple, building an object-tracking element for the Pitivi editor.

Then he went where mistakes cost real money. At Chorus One he built fault-tolerant infrastructure for proof-of-stake validators holding more than two billion dollars in stake. He did protocol research for IoT startups and helped Fortune 100 companies plan their infrastructure. He reads papers with the three-pass method and writes Rust by preference.

Mufeed knew how systems break. Vivek knew how they are held together. The agent would need both.

ChatGPT launched on November 30, 2022. Nine days later Mufeed published Security in the age of LLMs, an essay on what happens to threat models once a language model sits between a user and a system.

It described prompt injection before most people had a name for it. It predicted jailbreaks that end in code execution, with the exploit written in plain English. And it carried the idea the company was built on: if a model can read code and reason about it, it can do the work of a security researcher. So can the attacker's model.

In February 2024 they incorporated Stition, Inc. and gave it a single line of purpose: the pre-AGI security company.

The argument is simple to state and hard to act on. Between now and AGI there is a window in which AI makes attacking software cheap long before it makes defending software cheap. Every codebase written in that window will be read by models, and some of those models will be pointed at it by attackers. Defense has to become AI-native while the window is still open.

Stition would close it in steps. Step 0 was a hacker made of software.

On March 12, 2024, Cognition showed Devin, an autonomous software engineer. Mufeed posted a joke about Devin having an Indian cousin called Devika. Then he built her, in about twenty hours of coding across three days, and put her on GitHub.

Devika planned, researched, and wrote code from a single instruction. She passed 19,000 stars, drew dozens of contributors, and made national news as India's answer to Devin. She also proved something uncomfortable. Agents could now write software at speed, and nothing in the loop was checking whether that software was safe.

That summer Stition joined Y Combinator's S24 batch and shipped its first product. Asterisk was an AI hacker that found vulnerabilities, exploited them in a sandbox, patched them, and reported only what it could prove.

It was built to work the way a human auditor works. Index the codebase into a call graph that any language could fill, even Arc, the Lisp dialect behind the original Hacker News. Learn what the software is for. Model the threats that matter to that kind of software. Hunt, exploit, patch in the codebase's own style, and write the report.

Within months its reports had reached Google, Supabase, Sentry, Cal.com, Gumroad, Bun, and Hoppscotch.

In 2025 the team kept shipping in the open. Claudia, a desktop app for Claude Code that later became opcode, passed 22,000 stars. Blockoli and stackwalk taught agents to index huge codebases and walk their call stacks in any language. Every tool made the agent better at reading code the way an attacker does.

The findings got sharper. An authentication bypass in Anthropic's FastMCP. SQL injection in Supabase. A zero-click account takeover in Gumroad. A permission-model bypass in Node.js. Authorization, tenancy, and business logic: the classes of bug that pattern scanners were never built to see.

In 2026 the agent went after the hardest code there is. It found a type confusion in Chromium's V8 and heap overflows in NGINX, in code fuzzed for decades and read by millions of engineers. Running only open models on our harness, it found six NGINX vulnerabilities, five of them credited in F5's advisories. It found unauthenticated remote code execution in Ray, cross-tenant takeovers in SaaS platforms, and CVEs in React, Node.js, and Mattermost.

We publish every finding we are allowed to, with the trace, the proof, and the patch. We built N-Day-Bench, a monthly benchmark that tests frontier models on real vulnerabilities disclosed after their training cutoff, so anyone can check how good the models, and we, really are.

Here is the problem we arrived at. Code is now written faster than it can be secured. Scanners bury teams in patterns. Pentests take a snapshot and leave. An attacker with a model needs one path, and the models are getting better at finding all of them.

The answer is a defender that thinks like the attacker: one that reads the whole codebase, proves the exploit, and ships the fix before the code merges. That is winfunc.

It is step 0. The steps after it follow the same line, from securing the code AI writes to securing the agents that write it.