Collinear Zero

Collinear Zero is an open-source defensive cybersecurity agent harness from AI data and evaluation company Collinear AI. The blog post went up on October 30, 2026, and the official launch on X came on November 2, 2026. Instead of replacing your coding agent, it installs into existing tools such as OpenCode, Claude Code and Codex and adds independent attack testing, one fix round and a final recheck to the audit-and-patch workflow.

On Collinear's own CWE-bench v1, adding Zero to OpenCode with Opus 5.5 raises pass@1 from 67.1% to 72.9%, and with DeepSeek V4.1 Flash 1017 it improves results at roughly $0.15–0.21 per attempt, which is why Collinear calls it Pareto-optimal.

How it works

1. Rules plus skills: the agent gets rules (fail closed, the task outranks existing tests, handle every input form, never weaken a check after it ran), a security-patch skill and 15 short guides, one per weakness class (injection, SSRF, path handling, crypto, deserialization, and so on).
2. An independent tester attacks the patch: after the agent saves a checkpoint, a fresh tester session that sees only the task and the original repo diffs the patch, tries attack variants, and reports bypasses, regressions or untestable requirements.
3. A simple filter: a parsing script, not a model, decides what reaches the agent. A regression is forwarded only if a real test, doc or example in the repo backs it, so the tester cannot invent requirements.
4. One fix round plus recheck: the agent fixes once; if legitimate-use checks then fail, it reverts to the checkpoint.

Reported results (self-reported)

It costs about 1.5x to 3.8x as much as plain OpenCode per attempt. CWE-bench v1 has 120 private audit-and-patch tasks covering 73 CWEs.

When it fits

• Security teams using coding agents to patch vulnerabilities or security findings at scale who worry about patches that block only one case or break legitimate use.
• Teams wanting cheaper open models (e.g. DeepSeek V4.1 Flash) for security patching that get closer to pricier closed models.
• Researchers studying defensive security agent evaluation and harness design.

Getting started

1. Go to collinear-ai/collinear-zero on GitHub and install it into OpenCode, Claude Code or Codex.
2. Give the agent a repo and a weakness description; Zero runs the independent tester and recheck automatically.
3. Tune the number of fix rounds (one by default).
4. Use the cwe-bench.com leaderboard and methodology to evaluate your own pipeline.