An open-source framework called DeepZero that automatically hunts for vulnerabilities in Windows kernel drivers using AI agents has been released. The GitHub repository , offered under the MIT license, is designed to parse and decompile thousands of drivers and surface exploitable IOCTL handlers.
Open Source · AI Security Research
DeepZero: AI Agents Automate Windows Kernel Driver Vulnerability Hunting
An open-source pipeline ingests thousands of .sys drivers, then chains decompilation, static analysis and LLM-based agents to flag exploitable IOCTLs — turning large-scale kernel bug hunting into a declarative, resumable workflow.
1000s
Drivers per run, via parallel execution + resumable state
Ring 0
Where .sys drivers run — flaws enable LPE & EDR bypass
~490
GitHub stars · 63 forks — early but growing interest
The Pipeline — Declarative "Pipeline-as-YAML"
Ingest → Filter → Transform → LLM Assessment
Ghidra
Headless decompilation of drivers
→
Semgrep
Rule-based static analysis
→
DeepAgents
Agent-driven assessment loop
→
LiteLLM
Unified access to any LLM provider
Cost profile
The framework is free — you only pay for LLM API calls.
$0
DeepZero itself
~$4 / bug
Prior related
Cost is limited to the chosen model's API fees — plus the setup effort of Ghidra and Semgrep. Models such as Gemini 2.5 Pro can be swapped in via Vertex AI.
Where it shines
Scalable, declarative pipeline + parallelism
BYOVD vulnerable-driver hunting
Automated triage of IOCTL exploitability
Surfaces new candidates after excluding known bad drivers
The catch
LLM hallucinations & false positives
Manual triage still required — "AI-assisted," not autonomous
Ghidra / Semgrep setup cost; API fees at scale
Benchmarks & failure-case reports still early
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…