Web3 Devs Underground | Open-Kritt: AI Agents That Find Real Vulnerabilities
โOpen-Kritt: AI Agents That Find Real Vulnerabilities
๐ Hosted by: Web3 Developers Underground ร Gabriel Balko (ControlZ)
โโก Powered by: Masterkey VC
โIn January, Gabriel Balko told our community how an AI agent found a $250,000 bug.
โHe has since open-sourced the machine that found it. Open-Kritt passed 1,000 GitHub stars in two weeks, and researchers who are not him have started reporting five-figure bounties found with it.
โGabriel is coming back to take the architecture apart.
โHis own framing, and the reason this is worth an hour: Open-Kritt is not a press-the-button-get-a-vulnerability tool. It is infrastructure. It takes creativity, real domain understanding, and workflows you build yourself. That is the talk โ how the thing is put together, and how you actually drive it.
โ
โWhat we will cover:
โWhy one focused agent per entry point beats one strong agent holding the whole codebase
โโข Building workflows: chaining focused prompts into reusable research playbooks
โโข Anchored deduplication: recursively merging duplicate findings in small batches
โโข Relative ranking: scoring vulnerabilities against each other instead of against a rubric
โโข Repeat loops, and what model non-determinism actually costs per scan
โโข Tool-enabled agents running as root in disposable containers, and the threat model that demands
โโข What the agents reliably miss, and which bug classes are still human-only
โKritt reports 20+ High/Critical findings from a two-person team over nine months, a $250K single bounty, and a #1 finish in the Firedancer V1 audit competition on roughly $2,000 of tokens.
โIf you are building agent systems for anything at all - not just security - deduplication, ranking, isolation, and non-determinism are the same walls you are hitting. This is someone who solved them for money, showing his work.
โBring questions. The second half is live Q&A.
โSPEAKER
โGabriel Balko (ControlZ) - Security Researcher & Founder, ControlZ / Kritt. #18 all-time on Immunefi.
โWHEN
โWednesday, 19 August 2026
โ17:00 Israel ๐ฎ๐ฑ ยท 16:00 CET ยท 10:00 EDT
โ60+ minutes. English. Free.
โWatch live on YouTube: youtube.com/@web3devsunderground
โRepo: github.com/Kritt-ai/open-kritt
See you Online!
โWeb3 Devs Underground - Israel's largest technical community for Web3 developers and builders.
By Builders, For Builders.
web3devs.org