XBOW Blog

While it's great to clarify, LLMs are actually finding bugs and writing exploits [1][2]. There are more example though. [1] https://news.ycombinator.com/item?id=47589227 [2] https://xbow.com/

We've got a bunch of agent traces on the front page of the web site right now. We also have done writeups on individual vulnerabilities found by the system, mostly in open source right now (we did some fun scans of OSS projects found on Docker Hub). We have a bunch more coming up about the vulns found in bug bounty targets. The latter are bottlenecked by getting approval from the companies affected, unfortunately. Some of my favorites from what we've released so far: - Exploitation of an n-day RCE in Jenkins, where the agent managed to figure out the challenge environment was broken and used the RCE exploit to debug the server environment and work around the problem to solve the challenge: https://xbow.com/#debugging--testing--and-refining-a-jenkins-remote-co… - Authentication bypass in Scoold that allowed reading the server config (including API keys) and arbitrary file read: https://xbow.com/blog/xbow-scoold-vuln/ - The first post about our HackerOne findings, an XSS in Palo Alto Networks GlobalProtect VPN portal used by a bunch of companies: https://xbow.com/blog/xbow-globalprotect-xss/

you would likely be quite interested in the more quantitative writeup from a real research team ! it’s linked about midway in to the article - similar functionally can be reached, yes, but not always and never with fewer tokens than what mythos requires. https://xbow.com/blog/mythos-offensive-security-xbow-evaluation

I think this is a largely inflated PR stunt. Opus 4.6 was already capable of finding 0days and chaining together vulns to create exploits. See [0] and [1]. [0] https://www.csoonline.com/article/4153288/vim-and-gnu-emacs-claude-cod… [1] https://xbow.com/blog/top-1-how-xbow-did-it

Both are true, the difference is the skill level of the people who use / create programs to coordinate LLMs to generate those reports. The AI slop you see on curl's bug bounty program[1] (mostly) comes from people who are not hackers in the first place. In the contrary persons like the author are obviously skilled in security research and will definitely send valid bugs. Same can be said for people in my space who do build LLM-driven exploit development. In the US Xbow hired quite some skilled researchers [2] had some promising development for instance. [1] https://hackerone.com/curl/hacktivity [2] https://xbow.com/about

There is a related idea called "alloying" where the 2-4 candidate solutions are pursued in parallel with different models, yielding better results vs any single model. Very interesting ideas. https://xbow.com/blog/alloy-agents