CISA and FedRAMP have formalized the move away from the # of findings to now focusing on exposure + exploitability. For legacy providers this is the end of their old model, which relied on surfacing 100s or even 1000s of possible code pattern weaknesses with every scan xint.io/blog/fedramp...

How did one researcher's intuition combine with the scalability of AI to find the biggest Linux threat in years? Xint researcher Taeyang Lee will be presenting a deep dive at the Off By One Conference about his discovery of the Copy Fail Linux bug offbyone.sg/talk/taeyang...

The advantage of true AI AppSec is how it adapts the attack based on context like a human attacker would. AI wrappers to traditional automatic scanners help insofar as they reduce false positives but they do not have the same adaptability as true AI AppSec xint.io/blog/ai-wrap...

Yeah, the agent orchestration layer is where you actually earn your money. Most teams treat it like middleware that ships yesterday. The guardrails piece you're describing—that's not a checkbox, that's the whole game.

55,000+ hours of disruption-free testing across 2.5k+ domains in actual operating environments of major corporations and financial institutions. That's not a happy accident. It's the result of years of experience before unleashing autonomous AI agents into live environments. xint.io/blog/safe-au...

Our team's experience in practical offensive security is why we built Xint understanding what guardrails autonomous agents need when doing penetration testing on a live application - otherwise AI security can cause the same issues it was meant to prevent xint.io/blog/safe-au...

Get on the list for Xint Pulse - all of the capabilities of the award-winning Xint platform with no annual commitments. This is ideal for one-off compliance tests or startups/SMBs serious about securing their applications with limited budgets. xint.io/pulse-waitlist

"Our attack surface is expanding, but adding headcount is an impossibility." We are not trying to automate the human out of the loop. xint.io/blog/ai-cybe...

🚨 Interested in the quality of Xint results but needed a 1-time scan of a single live app (for example, for a one-time compliance scan of a vendor) instead of a longer-term commitment for several apps, servers, and APIs? Get on the waitlist for Xint Pulse - coming soon! xint.io/pulse-waitlist

Product Security is paying vendors to find vulnerabilities hackers will try to exploit. What they get instead is lists of hundreds (possibly) thousands of possible code weaknesses that add more noise instead of providing focus. xint.io/blog/171258

Speed wins - especially for startups. The ability to **securely** ship new features and updates is critical for building customer delight and trust at the same time. See how Z Enterprise does exactly that with Xint xint.io/blog/fintech...

Xint is now a certified platform with ISO/IEC 27001:2022 for information security management systems and ISO/IEC 27017:2015 for cloud service security. xint.io/blog/xint-du...

Unlike traditional DAST, which performs fixed tests targeting the same endpoints and APIs every time, Xint is intentionally designed so that individual scans run independently in a new context each time. xint.io/blog/ai-appl...

The latest models might show 10% improvements in certain benchmarks but increase costs by 2-10x depending on the complexity of the task. How do we deliver frontier-like performance while still maintaining predictable app/code scanning costs? xint.io/blog/increme...

We've been saying reliance on any one model, no matter how SOTA, is neither cost effective nor even that performant. Now it might not even be that reliable. xint.io/blog/167832

While certain governments are building clear offensive and defensive security policies with real resources put behind enforcement and compliance... federalnewsnetwork.com/commentary/2...

🚨 Happy to announce that we have been named Best Autonomous Pentesting Platform by @thehackernews.bsky.social: awards.thehackernews.com/winners/2026...

If you've encountered any cybersecurity marketing recently, you'll see everyone is claiming to be AI. But there are fundamental differences in how different vendors are integrating AI, leading to different levels of exposure when confronting AI-enabled attackers. xint.io/blog/ai-wrap...

Our CEO breaks down how AI attacks have become as good as a human being - only inexhaustible. The time and cost constraints that kept applications safe no longer holds: www.linkedin.com/feed/update/...

Coverage of the Redis bug and writeup we did with @wiz_io from @TheHackersNews: "The exploit needs an authenticated session, but in a default deployment, the default user already holds every privilege the chain requires..." thehackernews.com/2026/06/auto...

"Across these steps, Xint's approach was to use information from each response to construct the next request — progressively mapping what was reachable and what data could be extracted..." xint.io/blog/using-c...

We are particularly proud of this bug b/c of the subtlety in how it expressed itself - the vuln emerged from interaction of parts of the codebase far apart from each other. Humans and machines had scanned Redis and missed this high-sev bug until Xint came along. www.zeroday.cloud/blog/redis-c...

Point a smart enough model at your code and it finds the vulnerabilities. If the model is capable and the price is low or free, the exercise is done - right? Learn why the model is the cheapest input when using LLMs in the real world for offensive security xint.io/blog/167832

Check out the full interview with Xint researchers on the Google Wiz podcast. They cover: youtu.be/ZX1Ot50kYcU?...

If LLM results are non-deterministic, how can you rely on them for AppSec? With the right scaffolding, this is actually a strength of AI AppSec over traditional SAST and DAST. xint.io/blog/ai-appl...

The first question we get when talking with CISOs is if Xint/AI replaces human cyber experts because LLMs are so good at bug discovery. Short answer: no xint.io/blog/ai-cybe...

When @jameswilson.io reached out, he was upfront with his criticism for how we disclosed copy fail publicly. But we appreciated his willingness to listen and understand how AI has exposed risks in established disclosure protocals that had been dormant under the surface...

Our co-founders spoke w/Risky Business about what we learned as a result of the disclosure for copy fail and what it says about the reality of established disclosure processes when AI-armed attackers can backwards engineer an exploit in hours with just a CVE and a patch risky.biz/RBFEATURES22/

As a follow up to our copy fail research, here is our post sharing our PoC for container escape of this bug, which is part of why it was so unique xint.io/blog/copy-fa...

Verizon's DBIR is out & it backs up a lot of what we've been saying: -> More breaches are kicking off w/vuln exploitation -> AI tools are being used to automate the stages of an attack -> Orgs are patching fewer vulnerabilities and taking longer to do so. www.databreachtoday.co.uk/verizon-brea...

A huge thanks to Xint by Theori for becoming an OWASP Corporate Supporter! Xint.io brings AI-native AppSec that finds real vulnerabilities and proves exploitability in live apps, helping teams cut false positives, speed up validation, and triage with detailed trigger and impact reporting.

As a follow up to our copy fail research, here is our post sharing our PoC for container escape of this bug, which is part of why it was so unique xint.io/blog/copy-fa...

AI gets a lot of big headlines but lacks in transparency. As practical offensive security researchers we want to know not just if a SOTA model found a bug, but also what was the bycatch and what did it take for human beings to validate the findings xint.io/blog/xints-f...

SAST vendors call every finding a vulnerability because “we found 10,000 vulnerabilities” lands harder in a sales meeting than “we found 10,000 code patterns that might be risky.” But 10k "findings" isn't what product security teams need in the real world xint.io/blog/171258

Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986 xint.io/blog/kernel-...

What assumptions are you making about how your data is being used and stored when you use LLMs to find bugs in your code? xint.io/blog/zero-da...

CVE-2026-23479 was one of the high severity bugs we found when we won at Wiz's ZeroDay Cloud competition. Be on the lookout soon for the technical deep dive on ZDC blog redis.io/blog/securit...

When a SAST tool reports 10,000 vulnerabilities and a pen tester reports 50, most buyers read that as “the SAST tool is more thorough.” What it actually means is that the two tools are counting different things. xint.io/blog/171258

If you run MariaDB in production, take action now. Any user who can open a SQL session — whether through stolen credentials, SQL injection, or lateral movement — can reach this code path with a single function SQL statement. www.zeroday.cloud/blog/mariadb...

Review of our Mythos research paper. The TLDR: you can get better appsec performance in real-world conditions through scaffolding than with SOTA models that are invite-only www.youtube.com/watch?v=j7Co...

New on the Wiz ZeroDay Cloud blog: our researchers give technical deep dive on PostgreSQL pgcrypto heap buffer overflow leading to RCE. This particular bug had lain hidden in the codebase for over 20 years until we found it in just a few hours with AI. www.zeroday.cloud/blog/postgre...

After AIxCC wrapped in 2025, @DARPA worked with Xint and the other top performers to ensure the innovation continued even after the contest was done to secure the internet's open source infrastructure. Here is story of CVE-2026-31789 xint.io/blog/170315

CISA adds Copy Fail to their known exploited vulnerability (KEV) catalog www.cisa.gov/news-events/...

What did it look like when Xint found copy.fail? What makes Xint findings unique is not just finding a bug + location autonomously but also providing trigger conditions and exploit impact so the teams were able to quickly POC and prioritize as the high severity bug it turned out to be.

Patch your Linux boxes! Copy.Fail is a trivially exploitable logic bug in Linux, reachable on all major distros released in the last 9 years. A small, portable python script gets root on all platforms. Found by the teams at @theori_io and @xint_official More details below xint.io/blog/copy-fa...

'Before [Xint researcher] started working on automatic bug finding with AI he worked on vuln research, finding 0days & reporting them to maintainers. It used to take weeks or months to find a high-impact vulnerability in a brand-new codebase...now it only takes hours www.theverge.com/ai-artificia...

Our cofounder/CTO and VP of were interviewed as part of this article from @spectrum.ieee.org about what the ramifications are for the launch of #mythos. spectrum.ieee.org/anthropic-cl...

We're excited to join OpenAI's Trusted Access for Cyber program. This selective program ensures frontier capabilities for organizations defending the web's critical infrastructure. For Xint clients this means they are securing their applications and codebases with the most advanced models available

Join award-winning security researcher @tylerni7.bsky.social on @techstronggroup.bsky.social for this hands-on workshop for product security practitioners. webinars.techstronglearning.com/how-to-condu...

Complacency is the biggest risk in cyber. And nothing fosters more complacency than code that looks right and compiles right. Business logic vulnerabilities are particularly nefarious and particularly hard to catch precisely because the rules are being abused, not broken xint.io/blog/what-ar...