Deterministic breadth in seconds.
LLM-driven depth without a step cap.
Published 2026-09-11 · Updated 2026-09-13
R0 finds issues two complementary ways, and the split is the core of the design: a deterministic sweep for high-recall breadth in seconds, and an LLM-driven layer for the depth that only improvisation can reach.
What the LLM-driven layer can do that a scanner cannot
A signature scanner reports what matches a rule. The LLM-driven layer reasons: it reads the application's JavaScript to rebuild the real API behind the UI, tests every route for broken access control and IDOR, writes bespoke scripts, and correlates a secret found on one asset against an endpoint on another. That is the difference between a vulnerability scanner and a penetration test — and why the depth of a run is bounded by the surface, not by an iteration limit.
Deterministic sweep
~15 signature, DNS, TLS and HTTP probes fire in parallel and emit findings straight to the blackboard. This is where breadth — and high recall — comes from, before a single token is spent.
LLM improvisation
Subagents read the app’s JavaScript, reconstruct the real API surface, test every route for broken access control, write their own scripts, and chain discoveries across assets. This is where depth comes from.
Recall from the sweep. Precision from the model.
Signal escalates itself.
The sweep casts wide and cheap; the model spends its budget where the sweep — or another subagent — found smoke. A confirmed Critical or High doesn’t just get logged: it triggers a focused deep-dive of that asset, so the system concentrates effort exactly where the risk is.
See R0 run against
a target of yours.
A continuous, autonomous red team on hardware you own — no data ever leaves the box.