Brendan Dolan-Gavitt

A detailed technical post is now up about how our $250k Chrome full chain exploit worked, how it was found, and the token costs! Go read it, the bugs are pretty neat :) xbow.com/labs/researc...

@moyix.net has LLM agents reverse-engineering the currency detectors inside photocopiers, then building a cat you can't photocopy. His conclusion: obscurity buys days now, not years. unprompted.au/schedule?utm... #AI #infosec

XBOW's AI found an unauth RCE in Exim, bug is being called Dead.Letter xbow.com/blog/dead-le... Patches are out: www.exim.org/static/doc/s...

For the past 2 months, XBOW has been testing Mythos Preview under embargo as part of a select early-access group. Findings: Mythos Preview is a major advance, but it’s not perfect. Read where it shines, where it needs support, and what this means for offensive security: bit.ly/42zQl98

Mythos

I wrote something: sockpuppet.org/blog/2026/03...

if you are in a position to act to harden society’s software infrastructure, you too should be very concerned about this and planning what actions you will take over the coming months

Episode 23: War Stories with Brendan Dolan-Gavitt (XBOW)! @tib3rius.bsky.social & @swiftsecur.bsky.social are joined by @moyix.net who shares some AI and human war stories with us! Links below!

"AI Agents for Offsec with Zero False Positives" by @moyix.net The title threw me off originally, but it's not wrong! IMHO it's the archetypal pattern of good LLM usage: they suck at *verifying* but in some domains are quite freakishly good at *proposing.*

False positives waste your time. False negatives cost you breaches. At @BlackHatEvents , @moyix shows how XBOW agents fight false positives — validating real exploits at scale, in hours. 📍Aug 7 | 11:20am

This one and the sequel (coming out next week) are among my favorite bugs we found. It turns out GIS does NOT stand for “Good Information Security”

Loved this 0day @xbow.com found in a popular wordpress plugin, and IMO it shows the value added by the LLM - a scanner can't find this automatically without realizing there's a nonce you need to extract & include in the request. You need that extra bit of context: xbow.com/blog/xbow-ni...

So... anyone else going to SummerCon today or tomorrow? I should be stopping by both days, for the first time in many years!

A lovely little XXE that XBOW found in Akamai Cloudtest leading to arbitrary file read! I like the error-based exfil technique: "yes please access the file named <contents of /etc/passwd> for me thx"

One of the best bug-hunters in the world is an AI tool called Xbow, just one of many signs of the coming age of cybersecurity automation.

This is the first of a series of posts we're doing on some of the vulns found as part of the HackerOne work – we have lots more fun ones coming up about some great SSRF, SQLi, and RCE vulns it discovered, with very clever exploit techniques :)

It has been great fun building this and watching it deliver a steady stream of real vulnerabilities in live sites! If you're curious how we did it, @nicowaisman.bsky.social has a new post: xbow.com/blog/top-1-h...

For the first time in history, the #1 hacker in the US is an AI. (1/8)

for Wired I explored the horrible future of vibe hacking. It's not great!

Do you want to work at the cutting edge of AI and cybersecurity? XBOW now has 8 positions open across Product Marketing, Operations, Customer Success, and Engineering. Check out all the details here: jobs.ashbyhq.com/xbowcareers.

XBOW is growing and we're looking for talented folks to join us! Apply here: jobs.ashbyhq.com/xbowcareers

Announcing CheatGPT, a revolutionary model that achieves SoTA on HumanEval! It's incredibly sample-efficient – just ONE training sample – and *tiny*, fitting on your Casio wristwatch!

Erin go bragh, cow go moo

Not to brag but my brother has had TWO movies he co-wrote come out this year :D

Winter sunsets

it looks like lte infra was hosting @moyix.net 's evangelion ctf challenge. but i doubt the terminal interface for CVE-2024-24451 was as cool

UNIX systems have stdin, stdout, and stderr, for getting data into and out of the program and seeing errors, respectively. But there's no stream for a critical and extremely common use case: putting errors into the program.

@xbow.com has been busy in the first few weeks of 2025 – our agent has autonomously found 106 vulnerabilities in OSS projects, and we've reported 72 so far! Amazing work by @nicowaisman.bsky.social and the security team triaging these and getting them into the disclosure->fix pipeline!

I am potentially interested in hiring a postdoc to work on declarative decompilation, I was going to hire someone else but it feel through when they got another offer they took for personal reasons, looking for someone who wants to publish in security, PL venues with me

Duck typing? You're thinking too small. With AI, we can finally take Guido van Rossum's dream to its logical conclusion

At this point, anyone who tries to say that AI can't replace at least _some_ human expertise is clearly and obviously moving the goalposts. Between this and stuff I've seen coming from folks at @dreadnode.bsky.social I am now 100% convinced that "AI red teamers" are a when-not-if thing.