AI
What Fenrir Is and Where It Fits
Fenrir is Trend Micro’s zero-day vulnerability discovery engine, one half of a unified platform that pairs it with Mimir, a separate component for tracking known CVEs and threat research. The two systems share a bidirectional intelligence loop. After Fenrir found a command injection in Nvidia’s Isaac robotics framework, Mimir tracked the patch — then Fenrir found a patch bypass and a newly introduced bug in the same repo (0:58). Zero-day discovery and n-day research feed each other.
The Three-Stage Cascade Pipeline
Fenrir runs three stages in sequence. Static analysis tools (YaraX, Semgrep, CodeQL) scan first, each targeting a different class of signal. Yara sweeps millions of lines in seconds to surface candidates; Semgrep and CodeQL filter those down before anything reaches an LLM. What survives goes to L1 triage, a fast model pass that cuts obvious false positives without making any claims about exploitability. What survives that goes to L2 deep verify, a sandboxed agentic stage with PoC generation rights.
“We turn a maybe into a clear yes or no with evidence.” — Derek Chen
About 90% of findings that reach L2 are real vulnerabilities. Those go to a human researcher for disclosure.
L1 Triage: Fast Noise Reduction at Scale
L1 triage uses a fast model with 50 lines of pre-allocated code context. The goal is narrow: cut obvious false positives before they reach the expensive agentic stage. Prompts ask about a specific CWE class, not a generic “is this a bug?” question. The model is biased toward recall. Dropping a true positive here is unacceptable; letting a false positive through is fine.
The payoff is over 60% of findings filtered by a single Sonnet call. No multi-turn tool use, no Opus.
“15 lines of code instead of 12 turns of Opus. That is really a no-brainer.” — Derek Chen
Model sizing mattered. A 30.6B local model dropped true positives. Opus worked but capped throughput. Sonnet hit the right balance. Through their evaluation harness, L1 has not dropped a single finding later confirmed as a true positive by L2.
L2 Deep Agentic Verify: Turning Maybes Into Evidence
L2 runs Opus in an isolated sandbox with full execution rights. It can write Python, run Bash, trace data flow, build code graphs. The agent collects whatever context it needs on its own. Forced reflection is the key constraint: the model must argue against its own finding before it can confirm one, which catches the shallow reasoning that produces false positives. Median cost is $0.61 per finding, around 100,000 tokens. True positives work out to $8.80 each. Unreachable code, test files, and documentation get filtered before the agent ever sees them.
“We turn a maybe into a clear yes or no with evidence.” — Derek Chen
Production Results and Live Demo
Since deployment, Fenrir has submitted over 60 CVEs, with 100+ sitting in ZDI pre-disclosure and 3,000 pending review. The pipeline cuts 500 raw static findings down to 10–25 high-confidence true positives, delivering 2.5x more vulnerabilities found, 80% fewer false positives, and a 70% faster disclosure rate. Three times the team productivity.
During the talk, Girnus and Chen pulled up the console mid-presentation for the Live Fenrir scan of AION UI repo (18:16): 122 static findings, 37 filtered by L1, 21 true positives surfaced with path-traversal details, counter-arguments, and impact assessments. Each finding included a full disclosure package. The human’s job: verify exploitability and submit to the vendor. Then, mid-sentence, an alert arrived that a LangChain CVE had just been patched.
Q&A
Have you done retrospective analysis to check whether true positives are being dropped earlier in the pipeline? Yes — they keep records of all runs and use prior LLM outputs as future context to reinforce static analysis rule sets and run metrics against. ▶ 17:37
Have you experimented with different thinking levels for the models and the trade-offs involved? The current system predates extended thinking and runs at high thinking level; thinking-level tuning is planned for Fenrir 2.0. ▶ 19:38
Can you talk about the confidence score — what does medium mean versus low? The exact scoring formula is proprietary, but confidence is set dynamically at the LLM tree level and a human reviewer can query the agent directly to understand why a finding scored medium. ▶ 20:33
Notable Quotes
We turn a maybe into a clear yes or no with evidence. Derek Chen · ▶ 2:50
15 lines of code instead of 12 turns of Opus. That is really a no-brainer. Derek Chen · ▶ 10:14
We’re using AI to secure AI because the attack surface for AI components is absolutely massive. Peter Girnus · ▶ 16:04
We pointed this system at the AI ecosystem itself. Peter Girnus · ▶ 15:59
Key Takeaways
- Filter aggressively before spending on LLMs — a recall-biased fast model eliminates 60% of noise at near-zero cost.
- Force agents to disprove their own findings; adversarial reflection cuts hallucination-driven false positives in production.
- Use AI to hunt AI vulnerabilities — the expanding AI ecosystem is the highest-value, least-audited attack surface.