OxoSecurityOPERATOR
/
Back to product

OXO RESEARCH

How AI reorganises security engineering work.

One working context for the agent, the tools, the knowledge and the engineer — instead of seven tools that never share state.

RESEARCH PILLARS

  • Organise

    AI-Native Security WorkspaceWhy security work needs a workspace, not a chat window beside a toolchain.

  • Remember

    Workspace KnowledgeWhat the workspace keeps once an engineer or an agent has understood it.

  • Execute

    AI-Assisted Red TeamingAI performing security work: explore, inspect, execute, connect, report.

FEATURED RESEARCH

AI-Native Security Workspace

A security investigation spans a browser, an HTTP history, a source tree, a terminal and a tracker. This note examines what it costs when the engineer is the only thing connecting them — and what changes when the unit of work becomes a task-bound workspace.

Read the research

Updated October 28, 202614 min read

Security engineerobjective · authorised scope
Oxo Operatoragent loop · Codex SDK

Workspace context

  • Browserhttps://session-lab.local/login
  • TrafficGET200/loginPOST200/api/session
  • RequestPOST /api/sessionrevision 03 · retained
  • Files / codereturn sessionService.issue(identity)
  • Terminalpnpm vitest run session-boundary.test.tsexit 0
  • Spacesoriginals · source versions · navigation
  • Evidencetransaction #142 · revision 03 · exit 0
Application, HTTP requests, project files and terminal work share task context and records a reviewer can reopen.

LATEST RESEARCH

Selected space material

  • documents
  • source files
  • notes
Originals + local indexSave material, then check processing status

Source

session-boundary.md

Version

v3 · s_7f3a

Location

lines 12–16
Navigate → read originalAgents.md / search → bounded source evidence
Search and navigation lead to relevant original passages. A source version and location let the engineer reopen the context behind a conclusion.

Workspace Knowledge

Grounding Workspace Knowledge in Original Sources

Spaces connects project material to its original text, version and location. Search, navigation and references help agents find context and engineers check the basis of a conclusion.

Read the research

Updated October 28, 20268 min read

Discover
  1. Explore the targethttps://session-lab.local/login
  2. Inspect the requestPOST200/api/session
  3. Locate candidate codesrc/server/routes/session.ts:42
Operate
  1. Select a toolSemgrep · static analysis, runs locally
  2. Run local rulesSemgrep · bundled rule pack
  3. Read the resultrule matches · needs validation
Verify
  1. Verifyexit 0 · bound to revision 03
  2. Collect evidencetransaction #142 · revision 03
  3. Prepare a findingAuthentication boundary · needs review

One workspace context

  • browser
  • request
  • code
  • tool output
  • evidence

The request the agent captured in step two is the request it correlates in step six; the command it ran in step five is the receipt the finding cites.

Before: nine steps across five tools, each handoff a manual copy.

The workflow a security engineer already follows, in three stages — each step writing into the same record instead of into a different application.

AI-Assisted Red Teaming

AI-Assisted Red Teaming: From a Security Task to a Continuous Workflow

Red teaming a real application is mostly mechanical: the same request, the same handler and the same command, carried between tools by hand. This note asks how much of that an agent can perform, and where the engineer's judgement has to stay.

Read the research

Updated October 28, 202615 min read

Explore Oxo Operator