What we built
Back in spring 2026, after the powers of Mythos became known to humanity, we published on our blog an article on how AI changes the economics of vulnerability discovery. But that was not the only thing.
Inside our Brussels’ tower, something vastly more powerful was secretly being forged. Like the One ring forged in the Mount Doom, we developed Vigilo, a harness to guide AI models towards finding code vulnerabilities… One Harness to rule them all, One Harness to find them, One Harness to bring them all and in the darkness patch them.
But unlike the dark lord Sauron, after months of work, testing and reviewing, we decided to share our precious Vigilo with the people of the Middle-earth and open-source it to everyone, Elves and Dwarves included…and even Orcs, if they want to. You can find it on our GitHub.
What is Vigilo?
So, what is Vigilo? Vigilo is a harness to guide the work of AI agents towards reviewing code from a cybersecurity perspective.
Instead of relying on a single AI agent, it orchestrates specialised agents, each focused on one vulnerability class (e.g., injection, authentication, authorisation, cryptography or supply-chain dependencies), which share their discoveries through a common knowledge base.
It can run in two modes – white- and grey-box. In a white-box mode, Vigilo analyses the source code and, optionally, a running instance of the application scanned. In a grey-box mode, it tests only the running application, acting as an external attacker with valid credentials. An adversarial critique step re-examines every finding, challenging its severity and merging duplicates, so that only substantiated findings reach its final report.
Where source code is available, Vigilo can also automatically suggest a patch for each confirmed finding, on a separate branch ready for review by the code maintainers.
Vigilo was also part of the proof of concept on source code testing conducted by the European Union Agency for Cybersecurity (ENISA) using the frontier AI models. You can read the details about it on ENISA's website.
Added value for the community
With Vigilo now being open-source, organisations can deploy it on their own infrastructure, either as a command-line tool or as a multi-user web platform, using cloud-based or on-premises AI models.
The community feedback is always welcomed, so if you have any idea how to improve Vigilo, please contact us on services@cert.europa.eu.
Disclaimer: As with any AI-assisted review, findings and patches proposed by Vigilo should be validated by the code owners before any fix is applied.