NewN-Day-BenchView benchmark
winfunc
Research

Research and disclosures

Technical writing from the lab.

Findings·Hacktivity

Public vulnerability findings

Browse some of the publicly disclosed vulnerabilities autonomously discovered by Winfunc, with source-to-sink traces, impact notes, proof-of-concept details, and remediation context.

View Findings
Finding six NGINX vulnerabilities with open models
Research·July 23, 2026·16 min read

Finding six NGINX vulnerabilities with open models

We used GLM-5.1 and GLM-5.2 to scan NGINX. The scan produced six security findings with five CVE identifiers. This report describes the affected code, analysis traces, and proof conditions.

Hacking the old HackerNews codebase
Research·11 min read

Hacking the old HackerNews codebase

Auditing the old HackerNews codebase for security vulnerabilities with LLMs on a specialized harness.

What an automated vulnerability research system actually found
Research·8 min read

What an automated vulnerability research system actually found

Thirteen patched bugs across nine projects, including Node.js, React, NGINX, Mattermost, Supabase, Bun, Gumroad, Anthropic's MCP SDK, and Better-Auth. What the system got right, where it still falls over, and why executable PoCs matter more than model reasoning.

How Asterisk Works
Research·9 min read

How Asterisk Works

A repost of the original Asterisk architecture: how an AI security agent indexed code, generated attack ideas, verified vulnerabilities, and produced patches with low-noise reports.