Fabraix is a Y Combinator-backed security company whose product, Nyx, is an autonomous red-teaming harness for AI agents. Where static benchmarks and one-off audits capture a point-in-time snapshot, Nyx runs adaptive, multi-turn campaigns that reason across interactions and probe a target both directly and indirectly. The company reports that its agent beats frontier models on offensive security — a 78% attack success rate on the AgentHarm benchmark versus 67% for GPT-5.6 Sol — and that every attack feeds a self-learning loop so the red team sharpens with each run.
The mechanics matter as much as the results. Nyx is pure blackbox, meaning it needs no integration, source code, model weights or network access, and it tests an AI system the way a real user would. It runs thousands of simulations concurrently across voice, text and image inputs, deploying test websites on the fly for browser agents and constructing custom files for document agents. Documented findings range from sandbox escapes and credential exfiltration to network-egress bypasses of an LLM-as-judge and a jailbroken real-estate agent pushed into illegal discriminatory steering.
Fabraix frames this as continuous verification rather than a one-off pentest. Pointed at customer-support bots, coding agents, clinical copilots, research agents, multi-agent systems and trading agents, it is designed to surface the failure modes that slip past multi-turn flows, including RL reward hacking and prompt injection laundered through inputs. Security is addressed directly: blackbox operation adds almost nothing to the attack surface, runs are isolated and ephemeral, data is never used for training and encryption covers transit and rest. The free researcher tier, one-off scans and continuous CI/CD plans make the offering scale with how you test.
