NullRabbit Labs

Autonomous defence for decentralised networks.

NullRabbit Labs is the research arm of NullRabbit, a defensive security company building autonomous protection for blockchain validator infrastructure. We watch the outside of the perimeter: the network-layer attack surface that validator daemons expose to the open internet.

This organisation publishes the datasets, models, and interactive artefacts that come out of our research. Everything here is versioned, pre-registered, and audited on close.

What we work on

• Network-layer anomaly detection against validator RPC, gossip, and consensus surfaces
• Bundle format - an open, chain-agnostic representation of network traffic for security ML (nr-bundle-spec)
• Earned autonomy framework - governance layer for autonomous defensive systems (Zenodo DOI 10.5281/zenodo.18406828)
• Iterative leak-surface peeling - pre-registered ML methodology for adversarially robust security models

Coordinated disclosures

NullRabbit's research feeds a coordinated-disclosure track. Published advisories sit on nullrabbit.ai.

• NR-2026-001 - Agave RPC architectural findings (Solana), 2026-05-12
• NR-2026-002 - Sui Indexer-Alt findings, embargoed to 2026-06-20

Methodology

Every model on this page is trained against a versioned, immutable corpus and a pre-registered design document. Audits run on close against sanity floors, per-feature audit trails, and falsification holdouts. Where an audit fires, training halts, the design is re-registered, and the prior version is retracted in writing.

Corpus versions are increment-only. Published checkpoints reference the exact corpus version and pre-registration document used.

Links

• Website - nullrabbit.ai
• GitHub - NullRabbitLabs
• X - @NullRabbitLabs
• Earned autonomy paper - Zenodo

Contact

Research enquiries: simon@nullrabbit.ai