Nebula Security

Building Mythos for everyone

Active

Building Mythos for everyone

Nebula Security is an AI-native cybersecurity company founded by world-class hackers. Nebula Security provides Mythos-level cybersecurity reviews and product security auditing, conducted by our state-of-the-art AI agent and world-class hackers themselves, covering everything from code-level vulnerabilities to architectural weak points. We were the first team to build an nginx RCE and the first to root Android 17. Our co-founders include members of the world’s No. 1 CTF team, DEF CON winners, Black Hat speakers, and PhD in cybersecurity. We have won $400K in bug bounties by exploiting the Linux kernel and Chrome browser. “Audited by Nebula Security” is a mark of serious security credibility: a signal to customers, investors, and partners that your product has been reviewed by the world’s best hackers.

Active Founders

Eten Zou

CEO & Founder

CEO & Founder @ Nebula Security (YC S26). PhD in Cybersecurity. Focus on automated vulnerability research.

Eten Zou

CEO & Founder

CEO & Founder @ Nebula Security (YC S26). PhD in Cybersecurity. Focus on automated vulnerability research.

Yuan Tan

Founder

Founder at Nebula Security (YC S26). Black Hat USA speaker. PhD dropout in System Security with experience in DARPA-funded fundamental research on program analysis.

Yuan Tan

Founder

Founder at Nebula Security (YC S26). Black Hat USA speaker. PhD dropout in System Security with experience in DARPA-funded fundamental research on program analysis.

Frank Wu

Founder

Founder of Nebula Security (YC S26). Black Hat USA speaker and DEF CON finalist with r3kapig, the world's No. 1 hacking team in 2025. He led the DARPA AIxCC automated program repair team and shipped end-to-end RCE/LPE exploit chains on Chrome, Firefox, Linux, and Android. He pwned Google's kernelCTF multiple times with zero-days, and has published research at top academic venues such as USENIX Security and NDSS. Ph.D. dropout.

Frank Wu

Founder

Xiaochuan Yu

Founder

Founder at Nebula Security (YC S26). Hacked into iPhone, Chrome, Firefox, Safari, QEMU, and various things in your daily life. DEFCON finalist for 3 consecutive years. $200k+ Bug Bounty in Chrome. Core member of r3kapig, the #1 hacking team in the world in 2025, on CTFTime. M.S. from UC San Diego. Research published at USENIX Security, BlackHat. Ph.D. droped out.

Xiaochuan Yu

Founder

Company Launches

Nebula Security: Bringing beyond Mythos protection to your product

See original launch post

TL;DR: AI has changed cybersecurity. Don't let the next HuggingFace incident happen to your product. Hire VEGA, your best security engineer — a cybersecurity agent built by the world's best hacking team. It brings the same capabilities used to uncover critical vulnerabilities in browsers, operating systems, and internet infrastructure to protect your product. Book a demo today or find us at http://nebusec.ai

The Problem: Cybersecurity has changed. When the attackers have AI, how do you prevent the next HuggingFace incident from happening to your product?

We are here at Nebula Security for one reason, we are building the world’s best cybersecurity agent, bringing beyond Mythos protection to your product.

AI makes you fast. We make you secure

Introducing VEGA, the best cybersecurity agent that is built by the world's best hackers. An agent that has discovered critical vulnerabilities in major infrastructure and earned over $400K in rewards from Google.

Watch our launch video

With VEGA, you can:

Autonomously find bugs in your codebase
Monitor code changes 24/7
Analyze root causes and generate Proofs of Concept
Provide ready-to-use patches
Understand the overall code health

You focus on bringing your product to the world. We manage the security.

The world saw the proof

While ~~other companies~~ create hypes, we show you the proof.

VEGA discovered

IonStack: the world's first fullchain exploit to root Android 17.
GhostLock: a 15-year-old Linux kernel vulnerability capable of compromising nearly all the Linux devices in the world.
nginx-poolslip and nginx-quicburst: the world's first and second vulnerabilities capable of remotely control your Nginx servers
And 91 more CVEs from Linux, Windows, Chrome Browser, Firefox, Nginx, Wordpress, and the other software you use every day.

We found vulnerabilities in the world's most complex software. Let us protect your product too.

The epic hacker team

Eten (CEO): PhD in Cybersecurity; Pwn2Own winner; speaker at Linux Security Summit, Off-by-One, IEEE S&P, USENIX Security, and NDSS. Previously worked at Microsoft.
Yuan (CTO): Previous cybersecurity PhD; Black hat speaker; Bringing VEGA to secure Linux Kernel.
Xiaochuan (Research Lead): From the world's #1 hacking team; three-time DEFCON participant; Jailbreak iPhone; Black Hat speaker; Previously worked at Zellic.
Frank (Research Lead): From the world’s #1 hacking team; DEFCON participant; Black hat speaker. Built the world’s first Android 17 root exploit.

We have won over $400,000 from Google by breaking into their safest system.

Let us show you what we can find in your system. Book a demo today.

Find us at http://nebusec.ai | Email to founders@nebusec.ai

uploaded image