Vega review, pricing and verdict

Vega fits security teams shipping large C/C++ codebases, think browser engines, kernels, and other systems-level infrastructure, who would rather run continuous automated scans than periodic manual audits. One of its Linux kernel finds earned a $10,500 kernelCTF bounty, real evidence its exploits are exploitable, not academic. It replaces a first pass of manual research; a human reviews findings before disclosure.

Vega is an AI security agent from Nebula Security that autonomously hunts, root-causes, and patches vulnerabilities in C/C++ systems code. Its public research catalog credits it with 730+ documented bugs, including three named Chrome V8 CVEs in 2026. It ships as a GitHub App, a CLI, and an MCP server for Claude Code and Cursor.

Maker: Nebula Security · Autonomy: semi autonomous · Maturity: GA

Underlying models: Custom (proprietary)

About Vega

Vega is the flagship AI agent built by Nebula Security, a San Francisco based, Y Combinator backed security research lab founded in 2022. Unlike a general-purpose chatbot bolted onto static analysis tools, Vega bakes security domain knowledge directly into its agentic workflow: it reads source code, forms hypotheses about exploitable flaws, writes and runs proof-of-concept exploits, and validates its own findings before a human ever sees them.

What makes Vega an agent rather than a scanner is that it chains multi-step reasoning end to end, moving from recon over a codebase through root cause analysis, patch generation, and proof-of-concept validation, all before opening a pull request. Nebula's public research catalog credits Vega with three named 2026 CVEs, CVE-2026-6307 and CVE-2026-5865 in Chrome's V8 engine among them, plus a Linux kernel netfilter bug, CVE-2026-23274, that won a $10,500 kernelCTF bounty. Nebula claims the narrow, domain-tuned agentic loop behind these finds outperforms equivalent general-purpose GPT and Claude based security setups on Chromium and Linux kernel codebases specifically.

Vega is built for security teams and engineering orgs that ship large, security-critical C/C++ and systems codebases, think browser engines, kernels, and other low-level infrastructure, and want continuous automated vulnerability hunting instead of periodic manual audits. It is not a general chatbot assistant and is not aimed at casual developers; it is aimed at teams already running bug bounty programs or internal security research who want an AI agent doing the first pass of exploit discovery.

Pricing

Vega Scan is Nebula's self-serve tier: usage-based pricing tied to a repository's size and complexity, running automated vulnerability hunting, root cause analysis, patch generation, and PR review with no manual sign-off required to start. Premium Audit drops the self-serve model for a custom-quote engagement, pairing a senior Nebula security engineer with Vega to review architecture, model threats, and audit on-premise deployments. Neither tier lists a public price, and there is no free plan.

Key Features

• Autonomous vulnerability discovery: Vega has found and reported real bugs across major codebases, including the Linux kernel and Chrome V8, without a human writing the exploit chain.
• Full sandbox escape exploits: On CVE-2026-6307, Nebula reports Vega achieved arbitrary memory read/write and a complete V8 heap sandbox escape to RCE with a 100 percent success rate on its own, no additional bug chaining needed.
• Root cause analysis and patch generation: Vega Scan does not just flag a bug; it traces the root cause and generates a candidate patch alongside a proof of concept.
• GitHub App pull request review: Vega reviews incoming pull requests automatically as a GitHub App, catching vulnerable code before it merges.
• MCP integration for agentic coding: An MCP server exposes Vega inside Claude Code, Cursor, and other agent-driven IDEs so security scanning runs in the same loop as code generation.
• 90+30 day responsible disclosure: Every vulnerability Vega finds follows Nebula's standard 90-day vendor notice plus 30-day public disclosure window, tracked in a public research catalog of confirmed CVEs.

Strengths

• Publicly verified track record: three named CVEs in Chrome V8 and the Linux kernel in 2026 alone, including a full sandbox escape to remote code execution.
• Domain-tuned agentic pipeline reportedly outperforms general-purpose GPT and Claude based setups on Chromium and Linux kernel code specifically, per Nebula's own benchmarking.
• Three access modes (GitHub App, CLI, MCP) mean it slots into existing CI/CD and agentic coding workflows without a separate dashboard.
• A kernelCTF bounty payout on one of its Linux kernel finds shows the exploits it surfaces are real and monetizable, not academic false positives.

Weaknesses

• No published flat pricing; Vega Scan is usage-metered by repo size and Premium Audit is fully custom-quote, making budget planning hard for smaller teams.
• Focused almost entirely on C/C++ systems code (browser engines, kernels); teams working in typical web app stacks get far less demonstrated coverage.
• Underlying model architecture is undisclosed proprietary tooling, so buyers cannot independently verify what LLM or fine-tuning underlies the claimed benchmark wins.
• Very young company (YC seed round, roughly $500K raised as of 2023) with a small team, which is a risk factor for long-term support commitments on security-critical tooling.

Visit Vega Official Site