Brendan Dolan-Gavitt
@moyix.net
📤 2900
📥 876
📝 77
AI researcher at XBOW. Security, RE, ML. PGP
http://keybase.io/moyix/
reposted by
Brendan Dolan-Gavitt
Marcelo Rinesi
2 months ago
"AI Agents for Offsec with Zero False Positives" by
@moyix.net
The title threw me off originally, but it's not wrong! IMHO it's the archetypal pattern of good LLM usage: they suck at *verifying* but in some domains are quite freakishly good at *proposing.*
loading . . .
Black Hat
Black Hat
https://www.blackhat.com/us-25/briefings/schedule/index.html#ai-agents-for-offsec-with-zero-false-positives-46559
0
6
1
So, I’m not sure there is any good time to announce this, but as of August 31st I will be leaving NYU for good, to seek my fortune in industry with XBOW!
3 months ago
5
18
0
reposted by
Brendan Dolan-Gavitt
XBOW
3 months ago
False positives waste your time. False negatives cost you breaches. At @BlackHatEvents , @moyix shows how XBOW agents fight false positives — validating real exploits at scale, in hours. 📍Aug 7 | 11:20am
0
3
3
Can you read the exfiltrated file encoded in this image?
@xbow.com
figured out how to :D
3 months ago
1
4
2
This one and the sequel (coming out next week) are among my favorite bugs we found. It turns out GIS does NOT stand for “Good Information Security”
add a skeleton here at some point
3 months ago
1
3
0
Given two models with unique strengths, can we combine them to get the benefits of both w/o extra model calls? It turns out yes: just flip a coin at each turn to decide which model to query! This gave a jump from 25% to 55% on our benchmarks!
xbow.com/blog/alloy-a...
loading . . .
XBOW – Agents Built From Alloys
A simple, powerful innovation boosts performance in agentic AI systems.
https://xbow.com/blog/alloy-agents/
3 months ago
2
6
2
Loved this 0day
@xbow.com
found in a popular wordpress plugin, and IMO it shows the value added by the LLM - a scanner can't find this automatically without realizing there's a nonce you need to extract & include in the request. You need that extra bit of context:
xbow.com/blog/xbow-ni...
loading . . .
XBOW – XBOW battles Ninja Tables: Who’s the Real Ninja?
Sharing the story of how XBOW sniffed out a sneaky arbitrary file read bug in the popular WordPress Ninja Tables plugin.
https://xbow.com/blog/xbow-ninja-tables/
3 months ago
0
3
0
So... anyone else going to SummerCon today or tomorrow? I should be stopping by both days, for the first time in many years!
4 months ago
0
2
0
A lovely little XXE that XBOW found in Akamai Cloudtest leading to arbitrary file read! I like the error-based exfil technique: "yes please access the file named <contents of /etc/passwd> for me thx"
add a skeleton here at some point
4 months ago
1
6
0
reposted by
Brendan Dolan-Gavitt
WIRED
4 months ago
One of the best bug-hunters in the world is an AI tool called Xbow, just one of many signs of the coming age of cybersecurity automation.
loading . . .
AI Agents Are Getting Better at Writing Code—and Hacking It as Well
One of the best bug-hunters in the world is an AI tool called Xbow, just one of many signs of the coming age of cybersecurity automation.
https://wrd.cm/44nK6pz
2
69
9
This is the first of a series of posts we're doing on some of the vulns found as part of the HackerOne work – we have lots more fun ones coming up about some great SSRF, SQLi, and RCE vulns it discovered, with very clever exploit techniques :)
add a skeleton here at some point
4 months ago
0
8
3
It has been great fun building this and watching it deliver a steady stream of real vulnerabilities in live sites! If you're curious how we did it,
@nicowaisman.bsky.social
has a new post:
xbow.com/blog/top-1-h...
add a skeleton here at some point
4 months ago
0
10
3
reposted by
Brendan Dolan-Gavitt
XBOW
4 months ago
For the first time in history, the #1 hacker in the US is an AI. (1/8)
loading . . .
1
15
10
reposted by
Brendan Dolan-Gavitt
Matthew Gault
5 months ago
for Wired I explored the horrible future of vibe hacking. It's not great!
loading . . .
The Rise of ‘Vibe Hacking’ Is the Next AI Nightmare
In the very near future, victory will belong to the savvy blackhat hacker who uses AI to generate code at scale.
https://www.wired.com/story/youre-not-ready-for-ai-hacker-agents/
1
46
8
reposted by
Brendan Dolan-Gavitt
XBOW
5 months ago
Do you want to work at the cutting edge of AI and cybersecurity? XBOW now has 8 positions open across Product Marketing, Operations, Customer Success, and Engineering. Check out all the details here:
jobs.ashbyhq.com/xbowcareers
.
0
5
6
This is one of the dumber reasons I've had some software fail: dying because it couldn't call ftruncate on /dev/null
5 months ago
1
1
0
XBOW is growing and we're looking for talented folks to join us! Apply here:
jobs.ashbyhq.com/xbowcareers
6 months ago
1
7
3
Announcing CheatGPT, a revolutionary model that achieves SoTA on HumanEval! It's incredibly sample-efficient – just ONE training sample – and *tiny*, fitting on your Casio wristwatch!
7 months ago
1
6
0
Erin go bragh, cow go moo
7 months ago
0
2
0
Not to brag but my brother has had TWO movies he co-wrote come out this year :D
8 months ago
1
10
0
Winter sunsets
8 months ago
0
5
0
reposted by
Brendan Dolan-Gavitt
alkali
8 months ago
it looks like lte infra was hosting
@moyix.net
's evangelion ctf challenge. but i doubt the terminal interface for CVE-2024-24451 was as cool
add a skeleton here at some point
1
2
1
Making security benchmarks for AI is tricky sometimes
8 months ago
1
7
0
UNIX systems have stdin, stdout, and stderr, for getting data into and out of the program and seeing errors, respectively. But there's no stream for a critical and extremely common use case: putting errors into the program.
8 months ago
4
20
3
@xbow.com
has been busy in the first few weeks of 2025 – our agent has autonomously found 106 vulnerabilities in OSS projects, and we've reported 72 so far! Amazing work by
@nicowaisman.bsky.social
and the security team triaging these and getting them into the disclosure->fix pipeline!
9 months ago
2
18
6
reposted by
Brendan Dolan-Gavitt
Kristopher Micinski
9 months ago
I am potentially interested in hiring a postdoc to work on declarative decompilation, I was going to hire someone else but it feel through when they got another offer they took for personal reasons, looking for someone who wants to publish in security, PL venues with me
2
17
17
reposted by
Brendan Dolan-Gavitt
lcamtuf
10 months ago
My new C programming book is slowly taking shape. If you want to learn along, let's start with the basics of control flow:
godbolt.org/z/3GerY3zEc
1/5
8
70
19
Duck typing? You're thinking too small. With AI, we can finally take Guido van Rossum's dream to its logical conclusion
10 months ago
5
32
7
reposted by
Brendan Dolan-Gavitt
Rich Harang
10 months ago
At this point, anyone who tries to say that AI can't replace at least _some_ human expertise is clearly and obviously moving the goalposts. Between this and stuff I've seen coming from folks at
@dreadnode.bsky.social
I am now 100% convinced that "AI red teamers" are a when-not-if thing.
add a skeleton here at some point
1
15
2
reposted by
Brendan Dolan-Gavitt
XBOW
10 months ago
Just in time for the holidays: how XBOW found an arbitrary file download (CVE-2024-53982) in ZOO-Project, protecting Santa's critical geospatial processing infrastructure from attackers!
xbow.com/blog/xbow-zo...
loading . . .
XBOW – The Nightmare Before Christmas: An arbitrary file download on Zoo-Project
XBOW discovered an arbitrary file download vulnerability on the WPS open source app Zoo-Project.
https://xbow.com/blog/xbow-zoo-project-arb/
0
6
3
I do not want to create a "launch configuration json". I do not want to enter my command line arguments in a GUI. I am old and I want to type "gdb -p MYPROCESS"
10 months ago
1
5
0
reposted by
Brendan Dolan-Gavitt
XBOW
10 months ago
While developing XBOW over the past three months, we played around with using it for bug bounties and ended up at #11 in the US on HackerOne:
1
27
14
reposted by
Brendan Dolan-Gavitt
XBOW
11 months ago
XBOW found a stored XSS vulnerability (CVE-2024-52597) in the migration functionality of 2FAuth by crafting a malicious SVG file with a Javascript payload! Our latest blog post gives the full details:
xbow.com/blog/xbow-2f...
0
6
4
Great podcast interview with
@xbow.com
's CEO Oege de Moor! He discusses something you may have deduced from our recent blog posts: we're mining DockerHub to find & report vulnerabilities – and each vuln we find becomes a new benchmark for us to train/test on :D
www.youtube.com/watch?v=9mIp...
loading . . .
XBOW CEO and GitHub Copilot Creator Oege de Moor: Cracking the Code on Offensive Security With AI
YouTube video by Sequoia Capital
https://www.youtube.com/watch?v=9mIphDV9m9c
11 months ago
0
6
1
reposted by
Brendan Dolan-Gavitt
XBOW
11 months ago
XBOW found a critical path traversal vulnerability in ZOO-Project (CVE-2024-53982). The vulnerability exists in the Echo example (enabled by default) and allows an attacker to retrieve any file on the server. Users should upgrade to the latest version.
0
8
5
hurts_just_a_little_bit.jpg
11 months ago
0
27
1
reposted by
Brendan Dolan-Gavitt
XBOW
11 months ago
AI vs AI: How XBOW found a path traversal vulnerability (CVE-2024-53844) in LabsAI's EDDI, an open source conversational AI middleware.
xbow.com/blog/xbow-ed...
loading . . .
XBOW – LabsAI’s EDDI project path traversal
XBOW discovered a Path Traversal vulnerability in the open-source project, LabsAI’s EDDI.
https://xbow.com/blog/xbow-eddi-path/
0
4
3
reposted by
Brendan Dolan-Gavitt
XBOW
11 months ago
XBOW found a path traversal vulnerability (CVE-2024-53844) in LabsAI's EDDI project that allows attackers to download any file on the server. XBOW combined a series of URL encodings and path normalization bypasses to trigger the flaw. Users of versions 4.3–5.3 should upgrade.
0
13
3
reposted by
Brendan Dolan-Gavitt
Nicolas Grégoire
11 months ago
I’ve to say that I’m impressed by how
@xbow.com
managed to identify this SSRF vulnerability (and bypass a MIME filter on its way) 🤖
loading . . .
XBOW – SSRF & URI validation bypass in 2FAuth
XBOW discovered a Server-Side Request Forgery (SSRF) vulnerability in the OTP preview feature of the open-source project, 2FAuth.
https://xbow.com/blog/xbow-2fauth-ssrf/
2
17
14
New blog post by
@nicowaisman.bsky.social
on how XBOW found an SSRF in the OTP app 2FAuth (CVE-2024-52598) is now live!
xbow.com/blog/xbow-2f...
loading . . .
XBOW – SSRF & URI validation bypass in 2FAuth
XBOW discovered a Server-Side Request Forgery (SSRF) vulnerability in the OTP preview feature of the open-source project, 2FAuth.
https://xbow.com/blog/xbow-2fauth-ssrf/
11 months ago
1
9
2
Custom domain vanity handle: acquired
11 months ago
2
14
0
reposted by
Brendan Dolan-Gavitt
Matthew Green
11 months ago
Nice reverse engineering work to uncover the workings of iOS 18’s inactivity reboot.
naehrdine.blogspot.com/2024/11/reve...
loading . . .
Reverse Engineering iOS 18 Inactivity Reboot
Wireless and firmware hacking, PhD life, Technology
https://naehrdine.blogspot.com/2024/11/reverse-engineering-ios-18-inactivity.html
1
109
31
reposted by
Brendan Dolan-Gavitt
Ryan Castellucci 🜬
11 months ago
Oh, I never posted my gotofail story on here. Early 2014, someone came to me about a catastrophic vulnerability in Apple's TLS implementation. I shit you not, they'd overheard someone at a bar drunkenly bragging about how they were going to sell it to a FVEY intelligence agency for six figures.
7
460
122
Is there a way to discover starter packs by searching for ones that include certain people? E.g. if I want to find the "academic security" pack I can think of names that would likely be there.
blueskydirectory.com
doesn't seem to support this :(
loading . . .
The Ultimate Directory of tools and applications for Bluesky
A curated collection of all things relating to the Blue Sky social media platform.
https://blueskydirectory.com/
11 months ago
2
7
2
My current plan is to continue posting on the Other Site but also explore the exciting world of supporting TWO simultaneous social media addictions while working at a startup and raising a toddler
11 months ago
3
20
1
XBOW found a critical auth bypass (CVE-2024-50334) in Scoold, a widely-used open-source Q&A site, fully autonomously!
@nicowaisman.bsky.social
and I wrote up a post walking through the methodology it used – IMO it's a super cool bug and fascinating trace
xbow.com/blog/xbow-sc...
loading . . .
XBOW – How XBOW found a Scoold authentication bypass
As we shift our focus from benchmarks to real world applications, we will be sharing some of the most interesting vulnerabilities XBOW has found in real-world, open-source targets. The first of these ...
https://xbow.com/blog/xbow-scoold-vuln/
12 months ago
1
11
4
reposted by
Brendan Dolan-Gavitt
Richard Johnson
12 months ago
This awesome fuzzing blog post by
@r00tkitsmm.bsky.social
covers a super reliable macOS kernel binary rewriting to instrument any KEXT or XNU at BB or edge level. Mandatory reading for anyone interested in fuzzing whether you use MacOS or not. So many good system internals and fuzzing references!
loading . . .
Pishi: Coverage guided macOS KEXT fuzzing.
This blog post is the result of some weekend research, where I delved into Pishi, a static macOS kernel binary rewriting tool. During the weekdays, I focus on Linux kernel security at my job and would...
https://r00tkitsmm.github.io/fuzzing/2024/11/08/Pishi.html
2
37
15
reposted by
Brendan Dolan-Gavitt
Riley “caezar” E.
over 1 year ago
@moyix.bsky.social
posted this amazing chat archive with GPT-4 playing CTF.
moyix.net/~moyix/secre...
Punch line: with 25 years of experience, I’m not sure I would have solved this problem, and I’m positive I would have needed more tries.
0
1
1
I wrote a long thread about how my Evangelion-themed CSAW CTF pwn+crypto challenge NERV Center works- a select() based overflow that lets you break RSA challenge response authentication!
threadreaderapp.com/thread/17233...
loading . . .
Thread by @moyix on Thread Reader App
@moyix: Will still try to do a blog post on my @CSAW_NYUTandon CTF challenge, NERV Center, but for now here's a thread explaining the key mechanics. I put a lot of work into the aesthetics, like this....
https://threadreaderapp.com/thread/1723398619313603068.html
almost 2 years ago
0
2
0
Load more
feeds!
log in