1/ XBOW Unleashes GPT-5’s Hidden Hacking Power.  OpenAI 's initial assessment of GPT-5 showed modest cyber capabilities. But when integrated into the XBOW platform, we saw a completely different story: performance more than doubled.  More on what we found: 🧵

See autonomous pentesting live at #BlackHat! Next week, XBOW will run on active HackerOne programs from the expo floor. Watch AI agents find and validate real vulns—fast. 📍 Booth 3257

XBOW is now the #1 hacker on HackerOne, globally. For the first time, our autonomous AI pentester tops the worldwide leaderboard. Next week at #BlackHat, we’re taking it live: We’ll run real-time on HackerOne programs—come see XBOW find vulnerabilities. 📍 Booth 3257

Went hunting for geo-bypass. Found blind SQLi instead. /redacted/ + 'SLEEP' infused cookie = 15s nap. Logs don’t lie. Technical breakdown -> xbow.com/blog/xbow-geolocati...

“Even when we started Copilot, I wouldn’t have dreamt we’d soon have offensive security agents like XBOW.” CEO Oege de Moor joins Altimeter to talk: ⚔️ AI red teams 🥇 #1 on HackerOne 🔁 From quarterly scans → daily defense 🎥 Watch the full convo: bit.ly/4moktwc

False positives waste your time. False negatives cost you breaches. At @BlackHatEvents , @moyix shows how XBOW agents fight false positives — validating real exploits at scale, in hours. 📍Aug 7 | 11:20am

From SSRF discovery to RCE exploitation in 32 iterations. XBOW systematically analyzed TiTiler's expression parser, discovered Python execution through error patterns, then crafted payloads using subclass traversal to achieve command execution. Complete analysis: bit.ly/46XzOiA

AI-powered attacks evolve faster than most orgs can adapt. Recent trends: Attackers using LLMs for phishing Threat actors leveraging AI for vuln discovery Automated social engineering at scale The defense? Autonomous security that matches attacker velocity. More at BlackHat | Booth #3257 🎯

Even mature products hide critical flaws – and @xbow.com just found another one. CVE-2025-49493: XXE in Akamai CloudTest discovered during its climb to #1 on HackerOne. A complete technical breakdown from an error-based detection to a full exfiltration by Diego Jurado: xbow.com/blog/xbow-ak...

For the first time in history, the #1 hacker in the US is an AI. (1/8)

Do you want to work at the cutting edge of AI and cybersecurity? XBOW now has 8 positions open across Product Marketing, Operations, Customer Success, and Engineering. Check out all the details here: jobs.ashbyhq.com/xbowcareers.

XBOW is growing and we're looking for talented folks to join us! Apply here: jobs.ashbyhq.com/xbowcareers

Happy birthday, @xbow.com! Exactly one year ago we partnered with Konstantine at Sequoia, bringing the power of AI agents to cybersecurity. Here’s Konstantine summing up our year together, on CNBC. www.youtube.com/watch?v=jieB...

Just in time for the holidays: how XBOW found an arbitrary file download (CVE-2024-53982) in ZOO-Project, protecting Santa's critical geospatial processing infrastructure from attackers! xbow.com/blog/xbow-zo...

While developing XBOW over the past three months, we played around with using it for bug bounties and ended up at #11 in the US on HackerOne:

XBOW found a stored XSS vulnerability (CVE-2024-52597) in the migration functionality of 2FAuth by crafting a malicious SVG file with a Javascript payload! Our latest blog post gives the full details: xbow.com/blog/xbow-2f...

XBOW found a critical path traversal vulnerability in ZOO-Project (CVE-2024-53982). The vulnerability exists in the Echo example (enabled by default) and allows an attacker to retrieve any file on the server. Users should upgrade to the latest version.

AI vs AI: How XBOW found a path traversal vulnerability (CVE-2024-53844) in LabsAI's EDDI, an open source conversational AI middleware. xbow.com/blog/xbow-ed...

XBOW found a path traversal vulnerability (CVE-2024-53844) in LabsAI's EDDI project that allows attackers to download any file on the server. XBOW combined a series of URL encodings and path normalization bypasses to trigger the flaw. Users of versions 4.3–5.3 should upgrade.

XBOW identified a complex XSS vulnerability in WikiDocs (CVE-2024-53930), leveraging deep knowledge of KaTex to craft a macro exploit. Update to version 1.0.65. nvd.nist.gov/vuln/detail/...

I’ve to say that I’m impressed by how @xbow.com managed to identify this SSRF vulnerability (and bypass a MIME filter on its way) 🤖

XBOW bypasses a MIME-type filter, abusing an OTP icon preview feature in 2FAuth to exploit an SSRF and discover CVE 2024-52598. Affected users should apply the patch and read about all the details in our latest blog post: xbow.com/blog/xbow-2f...

XBOW autonomously discovered CVE-2024-50334, a critical authentication bypass in Scoold, an open-source Q&A webapp used by major companies like Cisco and IBM. Our recent blog post details how it found the flaw: xbow.com/blog/xbow-sc...