Web3 Devs Underground | Open-Kritt: AI Agents That Find Real Vulnerabilities

Open-Kritt: AI Agents That Find Real Vulnerabilities

🎙 Hosted by: Web3 Developers Underground × Gabriel Balko (ControlZ)
⚡ Powered by: Masterkey VC

In January, Gabriel Balko told our community how an AI agent found a $250,000 bug.
He has since open-sourced the machine that found it. Open-Kritt passed 1,000 GitHub stars in two weeks, and researchers who are not him have started reporting five-figure bounties found with it.
Gabriel is coming back to take the architecture apart.
His own framing, and the reason this is worth an hour: Open-Kritt is not a press-the-button-get-a-vulnerability tool. It is infrastructure. It takes creativity, real domain understanding, and workflows you build yourself. That is the talk — how the thing is put together, and how you actually drive it.

What we will cover:

• Why one focused agent per entry point beats one strong agent holding the whole codebase
• • Building workflows: chaining focused prompts into reusable research playbooks
• • Anchored deduplication: recursively merging duplicate findings in small batches
• • Relative ranking: scoring vulnerabilities against each other instead of against a rubric
• • Repeat loops, and what model non-determinism actually costs per scan
• • Tool-enabled agents running as root in disposable containers, and the threat model that demands
• • What the agents reliably miss, and which bug classes are still human-only

Kritt reports 20+ High/Critical findings from a two-person team over nine months, a $250K single bounty, and a #1 finish in the Firedancer V1 audit competition on roughly $2,000 of tokens.
If you are building agent systems for anything at all - not just security - deduplication, ranking, isolation, and non-determinism are the same walls you are hitting. This is someone who solved them for money, showing his work.
Bring questions. The second half is live Q&A.
SPEAKER
Gabriel Balko (ControlZ) - Security Researcher & Founder, ControlZ / Kritt. #18 all-time on Immunefi.
WHEN
Wednesday, 19 August 2026
17:00 Israel 🇮🇱 · 16:00 CET · 10:00 EDT
60+ minutes. English. Free.
Watch live on YouTube: youtube.com/@web3devsunderground
Repo: github.com/Kritt-ai/open-kritt

See you Online!
Web3 Devs Underground - Israel's largest technical community for Web3 developers and builders.
By Builders, For Builders.
web3devs.org