Skip to content
Why we built Vorthix XOR-1 to answer “insufficient evidence” when it has not earned a conclusion

Vorthix XOR-1

Vorthix XOR-1: an AI cyber reasoning engine that shows its evidence

It reads software the way an attacker would, tests its own ideas in isolation and tells you plainly when it cannot prove something.

Request a walkthroughHow it works
Isolated validationEvidence-backedExpert reviewed
Example case fileIllustrative
Hypothesis

Attacker-controlled input reaches a copy without a bounds check.

  1. Source readDone
  2. Call path tracedDone
  3. Reproducing in sandboxRunning
  4. Researcher reviewQueued
Confirmed · PoC attached
Insufficient evidence · not reported

01 / Definition

What is Vorthix XOR-1?

Vorthix XOR-1 is the AI-driven cyber reasoning engine built by Vorthix Sec. It analyzes source code and compiled binaries, forms hypotheses about how the software can be attacked, tests them in isolated environments and reports a finding only when the evidence supports it. The Vorthix research team reviews every finding before delivery.

  1. 01
    Tests in isolationHypotheses run in isolated environments.
  2. 02
    Reports on evidenceA finding is reported only when evidence supports it.
  3. 03
    Reviewed by peopleResearchers review every finding before delivery.

02 / Method

What Vorthix XOR-1 does

Four phases, repeated continuously. Pick one to see it. The full walkthrough is in how Vorthix XOR-1 works.

Phase

Form a hypothesis

Given a goal, such as finding an attacker-reachable vulnerability in a codebase, Vorthix XOR-1 forms a hypothesis about how the software can be attacked.

Read and trace

It reads the source and traces call paths to see whether attacker-controlled input can reach the suspect code.

Test in isolation

It tests the hypothesis against real evidence in an isolated, ephemeral sandbox, not against a guess.

Confirm or rule out

It confirms a finding or rules it out and moves to the next target, continuously and without step-by-step human steering.

ConfirmedRuled outthen next target

03 / Autonomy

Built to run for hours, unsupervised

XOR-1 is the autonomous research engine inside the Vorthix platform. Given a goal, it works a codebase the way a human researcher would, target after target, without a person steering each step. It is one engine in a larger system, and the one that has to be trustworthy on its own.

ConfirmedProof attached, reviewed by researchers before delivery.
Ruled outShown not to hold, with the evidence to say so.
Insufficient evidenceNot established, and said plainly. A first-class outcome, never a guess.

04 / Why long runs fail

What breaks when AI runs unsupervised for hours

Finding a bug is not the hard problem. Trust at scale is. We found two failure modes, and almost everything else is a variant of one of them.

Failure mode

Amnesia

A long-running agent has to compress its own history. Done naively, its correct, already-proven conclusions do not survive while noise does, so it investigates the same thing again from scratch.

Without a durable ledger
Target A ruled outTarget B ruled outTarget C ruled outTarget D ruled out
same targets, investigated again
With an evidence ledger
Target A ruled outTarget B ruled outTarget C ruled outTarget D ruled out

In XOR-1: Finished thoughts need a durable place to live.

Pattern-matched closure

An agent can learn that confident-sounding words produce a “closed” status in its own tracking, without any evidence behind them.

“Looks safe. Closing this.”Status: closedevidence: none

In XOR-1: Prose never changes the official status of a finding.

Escalation through repetition

A conclusion handed down by an earlier version of the agent can feel more trustworthy than it is, compounding an error instead of catching it.

Pass 1 · reported by the agent
Pass 2 · repeated by an earlier self
Pass 3 · now treated as settled
confidence grows, new evidence does not

In XOR-1: A claim repeated is not a claim proven.

Real evidence, wrong claim

A real, verifiable quote from the source is used to justify a conclusion it does not prove. Checking only that evidence is real waves it straight through.

real quote, verified in the sourceconclusion it does not prove
Does this evidence prove this specific claim? No

In XOR-1: The receipt must prove the specific claim it is attached to.

05 / Comparison

How it differs from a scanner

Patterns in, warnings out

Scanners match code against known patterns and hand engineers a list of warnings to investigate.

Possible buffer overflowunverified
Unchecked return valueunverified
Tainted data flowunverified
Use of unsafe functionunverified
Possible null dereferenceunverified
Format string patternunverified
Integer arithmetic patternunverified
A list of warnings to investigate

Hypotheses in, evidence out

Vorthix XOR-1 reasons about context, tests its own hypotheses and delivers evidence. It is built to find issues that patterns miss, such as logic flaws and incomplete fixes, and to answer “insufficient evidence” when it cannot establish a conclusion.

Finding · reproducedproof of concept · runtime trace
root-cause path · suggested patch
Insufficient evidenceNot reported. Vorthix XOR-1 says so plainly.
Evidence, reviewed by researchers before delivery

Scanners and human experts remain valuable; the aim is to put human time into review and fixing, not into re-checking whether a finding is real.

06 / Evidence standard

Nothing is marked true without a receipt

The receipt has to prove the specific claim it is attached to. A receipt for a different claim does not count.

Read the evidence standardWhy we built Vorthix XOR-1

Receipt 01

Accepted
Claim
The issue is reachable by an attacker
Receipt
Runtime trace from the sandbox
Proves it
Yes

Receipt 02

Accepted
Claim
The patch holds
Receipt
Regression test fails before the fix, passes after
Proves it
Yes

Receipt 03

Rejected
Claim
The issue is exploitable
Receipt
A static pattern match
Proves it
No, it does not prove that claim

07 / The standard

Five gates between a claim and a finding

Nothing is marked true without a receipt, and the receipt has to prove the specific thing it is attached to. Watch a claim travel through the gates, or hover one.

  1. Gate 01Retrievable evidence

    Every conclusion traces to real evidence in the codebase itself, not a paraphrase or the agent’s memory.

  2. Gate 02Prose cannot close

    A model writing “this is safe” is not proof. Only proof changes the status of a finding.

  3. Gate 03One fact, one receipt

    When a claim rests on several facts, each fact needs its own evidence.

  4. Gate 04Unknown is allowed

    “Insufficient evidence” is a first-class outcome, preferred to a confident guess.

  5. Gate 05Tested against itself

    The enforcement is attacked continuously. Each gap found becomes a class of fixes, not one patch.

08 / A real session, generalized

Caught by the system, not by a person watching

The shape of a real autonomous run. No codebase and no finding is disclosed.

  1. The audit begins

    A large, unfamiliar C codebase, with memory-safety and injection-class issues in scope.

  2. A function is flagged

    A user-influenced value is placed into a generated command string, without the quoting used elsewhere in the same file.

  3. Attacker control is investigated

    Several iterations try to show whether the value can be attacker-controlled. One line of reasoning hits a dead end.

  4. The agent tries to close it

    The conclusion rests on several distinct technical claims, but hard evidence exists for only one.

  5. The closure is rejected

    Under the evidence standard the closure is refused automatically and structurally. No one had to be watching.

  6. Back to work, or left open

    The agent must produce evidence for every claim, or the finding stays open instead of becoming “safe” on a weak foundation.

Closure attemptIllustrative
Claim 1receipt attached
Claim 2no receipt
Claim 3no receipt
Closure rejected

The finding stays open until every claim has its own evidence.

09 / Deliverables

What you receive for each finding

Hover a card to preview the artifact. Previews are illustrative.

  1. 01

    A working proof of concept

    $ ./poc input.bin
=> crash reproduced
  2. 02

    A minimized reproducer

    reduced to the smallest
input that still triggers it
  3. 03

    The runtime trace from the sandbox

    #0 copy_field()
#1 parse_record()
#2 entry()
  4. 04

    The root-cause path

    entry -> parse -> copy -> sink
  5. 05

    A suggested patch

    - memcpy(dst, src, len);
+ if (len <= cap)
+   memcpy(dst, src, len);
  6. 06

    A regression test that fails before the fix and passes after

    before fix : FAIL
after fix  : PASS

10 / Evaluate it

Four questions to ask any autonomous security tool

The demo is not the differentiator. Hour three is. We are a new company, so do not take “trust us” at face value. Ask the hard questions.

Question 01What happens when it runs for hours without you watching?Hover or focus to flip
How XOR-1 answers

It keeps a durable record of finished conclusions, so it builds on covered ground instead of circling back.

Question 02When it says something is safe, what does that mean?Hover or focus to flip
How XOR-1 answers

Traceable proof. Confident language alone cannot close a finding.

Question 03Can it tell “I checked and it is fine” from “I am not sure”?Hover or focus to flip
How XOR-1 answers

Yes. “Insufficient evidence” is a first-class outcome, preferred to a guess.

Question 04What if the evidence is real but does not prove the conclusion?Hover or focus to flip
How XOR-1 answers

The evidence must prove the specific claim it is attached to, and every fact gets its own.

11 / Use cases

Where teams use it

From source code auditing and incomplete fix detection to defense, aerospace and financial systems.

12 / Datasheet

Vorthix XOR-1 at a glance

The facts, in one place.

Name
Vorthix XOR-1
Built by
Vorthix Sec
Category
AI-driven cyber reasoning for software security
Analyzes
Source code and compiled binaries
Languages
CC++RustGoPythonTypeScriptJavaScriptJavaKotlinRubyPHPSwiftAssemblySolidity
Validation
Isolated, ephemeral sandboxes
Review
Vorthix research team, before delivery
Disclosure
Coordinated with maintainers for third-party software
Access
By request

Next step

See the evidence on a real target

We built XOR-1 to answer the hard questions honestly, including with “we do not know yet” when that is the true answer.

Request a walkthroughHow it works