🕧 7 min

Grego AI announced today the company has emerged from stealth with the industry’s first method for detecting critical software vulnerabilities with AI, called Deep Invariant Analysis. The new technical breakthrough represents a fundamental shift in what is now detectable in software security. An entire class of critical vulnerabilities that were previously invisible to human review is now within reach.

Read More: ITTech Pulse Exclusive Interview with Stanley R. Hughey, Chief Technology Officer at iNet

Founded in 2024 by Justus Hanna (CEO) top 30 globally ranked bug bounty hunter, and Gregorio Maspero (CTO) a 24-year-old national math olympiad gold medalist, Grego AI’s seed round was led by cyber•Fund and is also backed by some of the industry’s largest names, including Guillermo Rauch, founder and CEO of Vercel.

Grego AI’s system is extracting a level of reasoning and code comprehension from existing models that the models were not originally designed to achieve. All possible because of their proprietary architecture, training methodology, multi-agent sandboxed orchestration, and self-refinement pipeline built around it. Grego AI has discovered how to push existing models far beyond their expected capabilities, unlocking a depth of reasoning that even the model creators haven’t tapped into yet.

“The frontier models from the leading labs all have a big reasoning limitation. Even for their max versions, they can’t hold and trace complex logic across many layers of interacting systems. And no AI lab was able to solve this. But we did. We built our own reasoning architecture that fixes that. For the same models, we get a completely different level of output. It’s like the model was running at 30% and nobody noticed. We’ve already been approached by one of the major AI labs to explore what we’ve built. We can’t disclose who, but the interest tells you everything about where this is heading”

Gregorio Maspero, Co-Founder & CTO of Grego AI

Breaking Through the Cognitive Ceiling

Human auditors check vulnerabilities they can see. But in a codebase with hundreds of thousands of lines of code, there are vulnerabilities that only emerge from the interaction of 5, 6, 7+ layers of system dependencies — vulnerabilities that no human even knows to check, because they can’t see far enough into the system to know they exist.

Deep Invariant Analysis ingests an entire codebase, maps every module and dependency, and builds a complete model of how every component interacts. It then systematically tests invariants across depths that are unreachable by manual review, launching autonomous sub-agents that each explore a different interaction path, spinning up sandbox environments to write and test proof-of-concept exploits, and iterating on attack paths until it either confirms a vulnerability is real and reproducible, or kills it.

Over the past months, the system has already confirmed critical findings in Ethereum, Lido, Chainlink, Aave, Uniswap, Reserve, Polygon, and other major protocols, all previously audited multiple times by top-tier firms. Each of those findings was missed by every human reviewer.

Proof is in the Bounty

After more than a year of development, the system prevented a $27.7 million exploit in a major blockchain protocol and earned the largest-ever bug bounty paid for a vulnerability fully discovered by an AI system of $250,000.

Web3 was deliberately chosen as the proving ground as it’s the most audited, highest-stakes environment in software, where a single critical finding translates to immediate loss of funds. But the long-term vision goes far beyond crypto. If the system can find what every top auditor missed here, it can do the same for financial infrastructure, healthcare systems, cloud platforms, government and defense.

Grego AI currently holds the number one spot on the leaderboards for an AI security tool on both Immunefi and Hackenproof, given the company’s innovative approach to identifying bug bounties at speed.

Write to us [⁠wasim.a@demandmediaagency.com] to learn more about our exclusive editorial packages and programmes.