XBOW has been named to #TheAgenticList2026! 🎉 Honored to be recognized as a top trending agentic AI company. We’re building autonomous offensive security to deliver security outcomes that matter. Thank you to our customers, partners, and team. 🔗 https://www.agentconference.com/agenticlist/2026

The breakthrough isn’t speed alone. It’s scale. In @thenewstack.io, GitLab CISO Josh Lemos explores how autonomous agents like XBOW are accelerating vulnerability discovery at machine scale and what security leaders must rethink in response: https://bit.ly/4aMeJbj

Autonomous pentesting is one click closer. 🖱️ XBOW is now available on AWS Marketplace. To mark the launch, AWS customers can get 50% off XBOW Lightspeed for a limited time: https://bit.ly/46YLctI

Traditional scanners flood teams with alerts. Triage becomes the bottleneck. Autonomous pentesting chains static + dynamic testing and validates exploits before reporting. No noise. No false positives. 📄 Read the whitepaper: https://xbow.com/whitepaper/autonomous-pentesting-without-false-positives

Our CEO & Founder explains on the Boss Class podcast why the best defense in an AI-driven world is a strong, automated offense. But as organizations race to keep up with AI threats, there will be a chaos phase, before systems are fully ahead. Subscribe to listen here: https://econ.st/406FKBe

🗓️ Still haven’t registered for this week’s webinar? There’s time! Join our experts for a trace-level walkthrough of how real IDORs are discovered using creative reasoning, going beyond traditional scanners to find vulnerabilities that others miss. Register: xbow.com/webinar-trac...

We’re going to #RSAC 📍 Attending? Here’s how to connect with us: 👋 Meet our team at Booth #1843 💬 Chat 1:1 with our experts ▶️ Catch live demos 🗓 Pick the brains of our founders and executive team about the future of offensive security in the AI-threat landscape 🔗 https://bit.ly/4qWj9Db

Real attackers. Real results. In just a few clicks, see how your apps stand up to real-world attackers and get a clear path forward. Learn if your team qualifies for a free Lightspeed pre-flight: https://xbow.com/pentest-lightspeed #AppSec #OffensiveSecurity #Cybersecurity

XBOW bridges the gap between automated scanning and manual testing. The result: creative reasoning that doesn’t stop at 403s or 502s, and uncovers real threats. The Hacker News on two newly discovered IDORs in Spree: https://bit.ly/4bFH19x

📣 XBOW is now available on AWS Marketplace! AWS customers can now purchase XBOW through their existing workflows & use committed spend, while getting pentest results in hours, backed by real exploit validation. Read about the partnership & a limited-time 50% for XBOW Lightspeed: bit.ly/4qnVrPk

Come see XBOW in action 🔍 Learn how IDORs are discovered and exploited in practice. Leave with insight into: • Why scanners fail at IDORs • How agentic reasoning over objects, roles, and auth states finds and stops them Register: https://bit.ly/3ZNIQdg

Aim for what matters every time. 🎯 Hear from our partner Rhymetec about how they conduct AI-powered pentesting in real-world deployments. Here’s what autonomous offensive security in action looks like: https://bit.ly/4q95DLc

Most IDORs aren’t “guess the next number.” They hide in real authorization logic. In our latest Tales from the Trace, XBOW uncovered two zero-day IDORs by reasoning through the app like a pentester, even after 403s and 502s. Check it out: https://bit.ly/4kmlmpg

Traditional DAST ≠ dev-friendly. That's why we go beyond traditional DAST, delivering AI-generated vulnerability reports that provide real exploit paths, app behavior, and code context, so teams can fix faster. Read more in Tales from the Trace 👉 https://bit.ly/4rr5Jz1

The AI arms race doesn’t mean defenders lose. Our CEO, Oege de Moor, joined @economist.com’s new "Boss Class" podcast to discuss how AI is accelerating real-world pentesting and ultimately giving the good guys better tools. Link in replies 🔗

Introducing the XBOW Public API Run expert-level pentests at machine speed, now at infrastructure scale. Embed autonomous pentesting directly into your workflows: launch assessments, pull findings, stream results via webhooks, and more. Read the announcement: https://bit.ly/45Kkq7V

Can XBOW hack your app? Find out how your app holds up against real-world attackers. 👉 See for yourself: https://bit.ly/49WNjPy

New look. Same mission. 🏹 Our visual identity is evolving, but our focus hasn’t changed: redefining how organizations think about offensive security by transforming application security with AI-powered, continuous offense. Explore what’s new: https://bit.ly/3ZDQVkx

We’re thrilled to welcome WonLae Lee, a respected offensive security leader with decades of experience, as General Manager of South Korea. His leadership will play a key role as XBOW continues to grow across the Asia-Pacific region! https://bit.ly/49yjRR4

Where security goes on offense. Trained by top hackers, proven in the wild. Ranked #1 on HackerOne worldwide leaderboard. Explore it during our limited 10-day promotion. xbow.com/pentest

Seznam needed answers fast. XBOW delivered. ⚡ Real pentest results. No drag. No drama. For a limited time, we’re offering the same fast-track pentest experience and we will guarantee an exploit-validated security finding or you don’t pay. ⏰ Offer ends 12/26. 👉 xbow.com/pentest

Pentests that take weeks cannot secure software that changes daily. 🚀 XBOW Lightspeed provides expert-level testing in hours with autonomous offensive security. 📍 See it live at Booth 215 today!

🗓️ Today at the AI Summit join our talk on The Autonomous Offense Era: Securing a World Where Attackers Don’t Sleep XBOW's Nico, Aqueel, and Sarah unpack autonomous exploitation, what works, what fails, and what to expect next. 📍 Find us at Booth 215 for live walkthroughs after the session.

Huge appreciation to the Seznam team! On their first demo, XBOW identified a critical vulnerability with zero access and zero prep, just autonomous offensive security doing real work for a real customer. It’s the kind of partnership that proves what matters. www.youtube.com/watch?v=w4L2...

Black Hat Europe starts today! 📍 Booth 215 all week. Autonomous multi-agent offense. Human-level testing in hours. Full exploit validation. Come see it live.

AI-enabled attackers have already accelerated. The question: can your offensive security match their speed? Next week at Black Hat Europe, we’re showing how autonomous offense closes the security scale gap with human-level testing in hours. Let us show you how @ booth #215

Pentests that take weeks can’t secure software that changes daily. XBOW Lightspeed uses autonomous multi-agent offense to deliver human-level testing in hours, with full exploit validation and continuous coverage. xbow.com/pentest

1/ XBOW Unleashes GPT-5’s Hidden Hacking Power.  OpenAI 's initial assessment of GPT-5 showed modest cyber capabilities. But when integrated into the XBOW platform, we saw a completely different story: performance more than doubled.  More on what we found: 🧵

See autonomous pentesting live at #BlackHat! Next week, XBOW will run on active HackerOne programs from the expo floor. Watch AI agents find and validate real vulns—fast. 📍 Booth 3257

XBOW is now the #1 hacker on HackerOne, globally. For the first time, our autonomous AI pentester tops the worldwide leaderboard. Next week at #BlackHat, we’re taking it live: We’ll run real-time on HackerOne programs—come see XBOW find vulnerabilities. 📍 Booth 3257

Went hunting for geo-bypass. Found blind SQLi instead. /redacted/ + 'SLEEP' infused cookie = 15s nap. Logs don’t lie. Technical breakdown -> xbow.com/blog/xbow-geolocati...

“Even when we started Copilot, I wouldn’t have dreamt we’d soon have offensive security agents like XBOW.” CEO Oege de Moor joins Altimeter to talk: ⚔️ AI red teams 🥇 #1 on HackerOne 🔁 From quarterly scans → daily defense 🎥 Watch the full convo: bit.ly/4moktwc

False positives waste your time. False negatives cost you breaches. At @BlackHatEvents , @moyix shows how XBOW agents fight false positives — validating real exploits at scale, in hours. 📍Aug 7 | 11:20am

From SSRF discovery to RCE exploitation in 32 iterations. XBOW systematically analyzed TiTiler's expression parser, discovered Python execution through error patterns, then crafted payloads using subclass traversal to achieve command execution. Complete analysis: bit.ly/46XzOiA

AI-powered attacks evolve faster than most orgs can adapt. Recent trends: Attackers using LLMs for phishing Threat actors leveraging AI for vuln discovery Automated social engineering at scale The defense? Autonomous security that matches attacker velocity. More at BlackHat | Booth #3257 🎯

Even mature products hide critical flaws – and @xbow.com just found another one. CVE-2025-49493: XXE in Akamai CloudTest discovered during its climb to #1 on HackerOne. A complete technical breakdown from an error-based detection to a full exfiltration by Diego Jurado: xbow.com/blog/xbow-ak...

For the first time in history, the #1 hacker in the US is an AI. (1/8)

Do you want to work at the cutting edge of AI and cybersecurity? XBOW now has 8 positions open across Product Marketing, Operations, Customer Success, and Engineering. Check out all the details here: jobs.ashbyhq.com/xbowcareers.

XBOW is growing and we're looking for talented folks to join us! Apply here: jobs.ashbyhq.com/xbowcareers

Happy birthday, @xbow.com! Exactly one year ago we partnered with Konstantine at Sequoia, bringing the power of AI agents to cybersecurity. Here’s Konstantine summing up our year together, on CNBC. www.youtube.com/watch?v=jieB...

Just in time for the holidays: how XBOW found an arbitrary file download (CVE-2024-53982) in ZOO-Project, protecting Santa's critical geospatial processing infrastructure from attackers! xbow.com/blog/xbow-zo...

While developing XBOW over the past three months, we played around with using it for bug bounties and ended up at #11 in the US on HackerOne:

XBOW found a stored XSS vulnerability (CVE-2024-52597) in the migration functionality of 2FAuth by crafting a malicious SVG file with a Javascript payload! Our latest blog post gives the full details: xbow.com/blog/xbow-2f...

XBOW found a critical path traversal vulnerability in ZOO-Project (CVE-2024-53982). The vulnerability exists in the Echo example (enabled by default) and allows an attacker to retrieve any file on the server. Users should upgrade to the latest version.

AI vs AI: How XBOW found a path traversal vulnerability (CVE-2024-53844) in LabsAI's EDDI, an open source conversational AI middleware. xbow.com/blog/xbow-ed...

XBOW found a path traversal vulnerability (CVE-2024-53844) in LabsAI's EDDI project that allows attackers to download any file on the server. XBOW combined a series of URL encodings and path normalization bypasses to trigger the flaw. Users of versions 4.3–5.3 should upgrade.

XBOW identified a complex XSS vulnerability in WikiDocs (CVE-2024-53930), leveraging deep knowledge of KaTex to craft a macro exploit. Update to version 1.0.65. nvd.nist.gov/vuln/detail/...

I’ve to say that I’m impressed by how @xbow.com managed to identify this SSRF vulnerability (and bypass a MIME filter on its way) 🤖

XBOW bypasses a MIME-type filter, abusing an OTP icon preview feature in 2FAuth to exploit an SSRF and discover CVE 2024-52598. Affected users should apply the patch and read about all the details in our latest blog post: xbow.com/blog/xbow-2f...

XBOW autonomously discovered CVE-2024-50334, a critical authentication bypass in Scoold, an open-source Q&A webapp used by major companies like Cisco and IBM. Our recent blog post details how it found the flaw: xbow.com/blog/xbow-sc...