# DeepZero

An automated vulnerability-research pipeline engine that parses, decompiles and analyzes Windows kernel drivers for exploitable IOCTLs with AI agents, defined declaratively as a resumable, parallel YAML pipeline.

DeepZero is a pipeline engine for automated vulnerability research, built around chaining ingest, filter, transform and LLM-assessment stages declared in YAML. Its target application analyzes large numbers of Windows kernel drivers for exploitable IOCTL handlers, decompiling and assessing each one with AI agents rather than by hand.

The engine itself handles orchestration, parallel execution with a configurable thread pool per stage, and resumable runs: state is saved atomically per sample, so a run interrupted with Ctrl+C can be restarted from where it left off. LLM stages use Jinja2 prompt templates through LiteLLM, so any supported model provider can be used, and custom processing stages are written as Python classes referenced by path from the pipeline's YAML definition. A bundled demo pipeline runs on included text samples with no API keys, decompiler or driver corpus required, to demonstrate the engine without performing real vulnerability analysis.

It is written in Python, tested with Python 3.11 through 3.14, and its own linting and security checks run with ruff and bandit.

Website: http://blog.ahmadz.ai/DeepZero/