In autumn 2026, seven financial institutions in Korea were breached by a single open-source AI penetration tool, and roughly 65,000 customer records were taken. The attack path was not exotic: injection in a peripheral web app, authentication bypass, and bulk harvesting through sequential access. What changed was speed and autonomy.
Once an attack runs itself, the defense has to run itself too. That is the premise behind Chitos.
What autonomy looks like here
Chitos forms its own audit hypotheses from reconnaissance, and when one path is blocked it researches another and keeps going, widening coverage without a human spelling out each step. Then an AI verification layer re-reads every first-pass finding and filters false positives, so what you get is reproducible evidence, not a pile of maybes.
The numbers
On the OWASP Benchmark, the base scanner scores 52.8 Youden. With the AI verification layer, Chitos reaches 77.8 on-prem (Darwin-180B-RSI) and 77.2 online (Claude Opus 5.5), removing more than 60 percent of false positives while missing no real vulnerabilities. Publicly reported commercial tools sit in the mid-70s and above, and these self-measured figures land in that range.
Security should speak in evidence, not promises. We are stacking that evidence as numbers, with official cross-validation in progress.
More: https://vidraft.net
Top comments (0)