Glossary
Security research and cyber reasoning terms, defined
Short, self-contained definitions of the terms used across Vorthix XOR-1, our research and our write-ups.
AddressSanitizer (ASan)
- A compiler-based runtime tool that detects memory errors such as buffer overflows and use-after-free bugs as the program runs, giving a precise trace of where the error occurred.
Amnesia (agent failure mode)
- When a long-running AI agent redoes finished work because its own correct conclusions did not persist when its history was compressed. Failure modes explained
Attacker-reachable
- A vulnerability is attacker-reachable when untrusted input from outside the system can actually reach the flawed code. Reachability separates issues that can be used from issues that only look risky.
Coordinated disclosure
- Reporting a vulnerability privately to the maintainer or vendor first and publishing details only after a fix is available, so users have a remediation path before the details are public. Vorthix research and disclosure
CVE
- A Common Vulnerabilities and Exposures identifier, a standard public ID assigned to a specific vulnerability so that everyone refers to the same issue.
CWE
- The Common Weakness Enumeration, a community-maintained list of software weakness types, such as CWE-122 (heap-based buffer overflow).
Cyber reasoning
- Using AI to reason about how software can be attacked, instead of only matching it against known bug patterns. A cyber reasoning system forms a hypothesis, plans a test, reads the result and revises, until it can support a conclusion or reports that it cannot. How Vorthix XOR-1 works
Ephemeral sandbox
- An isolated environment created for one task and destroyed when the task ends. Vorthix runs every analysis in one, so customer code does not persist after the work is done. Privacy and trust FAQ
Evidence-gated
- A conclusion is accepted only when specific, retrievable evidence supports it, and each piece of evidence proves the claim it is attached to. Confident wording alone cannot close a finding. The evidence standard
False confidence (agent failure mode)
- When an AI agent declares a conclusion, such as “safe”, without having earned it. A confident but unproven result looks identical in a report to a correctly proven one.
False positive
- A reported issue that is not a real, exploitable problem. High false-positive rates push the cost of verification onto the reader of the report.
Heap buffer overflow (CWE-122)
- A memory-safety bug where a program writes or reads past the end of a heap-allocated buffer, potentially corrupting adjacent data. Heap buffer overflow guide
Incomplete fix
- A security patch that closes some, but not all, of the paths to a vulnerability. Detecting one means treating the patch as a claim and testing every code path that shares the assumption it relies on. Incomplete fix detection
Insufficient evidence
- A valid investigation outcome meaning the evidence gathered does not support a conclusion in either direction. Reporting it is preferable to guessing, because a guess can bury a real issue or invent a false one. Why we built it to say this
Minimized reproducer
- The smallest input or program that still triggers a vulnerability. A minimized reproducer makes root-cause analysis and regression testing faster.
Patch as claim
- The practice of reading a merged security fix as a testable statement (“this guard covers every path”) rather than as proof that the problem is solved.
Proof of concept (PoC)
- A small, working demonstration that a vulnerability exists, such as an input that triggers a crash. A PoC lets an engineer reproduce the problem without trusting the report.
Proof-based security research
- A methodology that reports a vulnerability only after it has been reproduced under controlled execution, for example a crash confirmed by a runtime sanitizer. Unconfirmed candidates are discarded or left open, not reported with a confidence score. Proof-based security research
Regression test
- A test that fails before a fix and passes after it, so the same defect cannot return unnoticed.
SAST (static application security testing)
- Tools that analyze source code without running it, usually by matching patterns or tracking data flow. They are fast and run on every commit, but cannot always tell whether a flagged pattern is reachable or exploitable.
Use-after-free (CWE-416)
- A memory-safety bug where a program uses memory after it has been released, which can lead to crashes or attacker-controlled behavior. Heap use-after-free guide
Variant analysis
- Searching for other places in a codebase that contain the same kind of flaw as a known vulnerability, because bugs and flawed assumptions usually repeat.
Vorthix XOR-1
- The AI-driven cyber reasoning engine built by Vorthix Sec. It analyzes source code and compiled binaries, forms hypotheses about how software can be attacked, tests them in isolated environments and reports a finding only when the evidence supports it. About Vorthix XOR-1
Request access
See how Vorthix works on your code
Access is currently by request for security teams and researchers.
- Working proof of concept
- Sanitizer-backed trace
- Suggested patch and regression test