Top all-time · #3319
XBOW
Company blog · xbow.com/blogsecurityai
XBOW is the company blog at xbow.com, writing about security and ai. Since 2024, 23 different Hacker News readers have linked it 57 times, most often “Mythos for Offensive Security: XBOW's Evaluation”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link XBOW's blog for its write-ups of vulnerabilities found by its autonomous AI pentesting system in open source and bug bounty targets, plus agent traces and evaluations of AI exploit generation.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
XBOW is an autonomous offensive security platform that simulates real attacks to find and validate vulnerabilities in your applications. Get a demo today.
Most-linked posts?
- Mythos for Offensive Security: XBOW's Evaluation5 people · 8 mentions · first linked 2026-05-12
- Agents built from alloys4 people · 4 mentions · first linked 2025-07-17
- Chrome Full-Chain Exploit with GPT 5.63 people · 3 mentions · first linked 2026-10-13
- Finding a Critical Vulnerability in Scoold with AI3 people · 3 mentions · first linked 2024-11-18
- XBOW: A new AI security company by the creators of GitHub Copilot2 people · 5 mentions · first linked 2024-07-15
- XBOW AI autonomously discovers path traversal in EDDI (CVE-2024-53844)2 people · 2 mentions · first linked 2024-12-02
- AI now matches the capabilities of a top human pentester2 people · 2 mentions · first linked 2024-08-05
- XML External Entity (XXE) Injection in Akamai CloudTest2 people · 2 mentions · first linked 2025-06-30
What Hacker News says?
We've got a bunch of agent traces on the front page of the web site right now. We also have done writeups on individual vulnerabilities found by the system, mostly in open source right now (we did some fun scans of OSS projects found on Docker Hub). We have a bunch more coming up about the vulns found in bug bounty targets. The latter are bottlenecked by getting approval from the companies affected, unfortunately. S…
Comment linking /blog/xbow-globalprotect-xss/
on “XBOW, an autonomous penetration tester, has reached the top spot on HackerOne”Submitted XBOW, an autonomous penetration tester, has reached the top spot on HackerOne as a story · 284 points
HN discussionThere is a related idea called "alloying" where the 2-4 candidate solutions are pursued in parallel with different models , yielding better results vs any single model. Very interesting ideas. https://xbow.com/blog/alloy-agents
Comment linking /blog/alloy-agents
on “Microsoft Amplifier”Submitted Agents built from alloys as a story · 181 points
HN discussionBTW, have you seen the new LLMsic offensive tools such as XBOW [1]? They just received a founding round from Sequoia Capital [2]. [1] https://xbow.com/ [2] https://www.sequoiacap.com/article/partnering-with-xbow-the-...
Comment linking /
on “LLM and Bug Finding: Insights from a $2M Winning Team in the White House's AIxCC”Submitted Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain as a story · 40 points
HN discussionI think this is a largely inflated PR stunt. Opus 4.6 was already capable of finding 0days and chaining together vulns to create exploits. See [0] and [1]. [0] https://www.csoonline.com/article/4153288/vim-and-gnu-emacs-... [1] https://xbow.com/blog/top-1-how-xbow-did-it
Comment linking /blog/top-1-how-xbow-did-it
on “Project Glasswing: Securing critical software for the AI era”Submitted GPT-5 doubles performance in offensive security benchmark as a story · 27 points
HN discussionNot only audit, but offensive security tools such as XBOW [1], backed by Sequoia and that finds and exploits vulnerabilities. I am on the waitlist though. [1] https://xbow.com/
Comment linking /
on “Base44 sells to Wix for $80M cash”Submitted XBOW: A new AI security company by the creators of GitHub Copilot as a story · 11 points
HN discussionWe've been using them to find novel vulnerabilities in open source web apps. The past 4 posts here have details: - Auth bypass/arbitrary file read in Scoold: https://xbow.com/blog/xbow-scoold-vuln/ - SSRF in 2FAuth: https://xbow.com/blog/xbow-2fauth-ssrf/ - Stored XSS in 2FAuth: https://xbow.com/blog/xbow-2fauth-xss/ - Path traversal in Labs.AI EDDI: https://xbow.com/blog/xbow-eddi-path/ Each of those has an associa…
Comment linking /blog/xbow-eddi-path/
on “Ask HN: Examples of agentic LLM systems in production?”Submitted XML External Entity (XXE) Injection in Akamai CloudTest as a story · 7 points
HN discussionAh, then you’ll want to check out xbow - https://xbow.com/blog I believe some folks here (moyix) are active with the project.
Comment linking /blog
on “Using AI to secure AI”Submitted Chrome Full-Chain Exploit with GPT 5.6 as a story · 4 points
HN discussionThis is a technical companion post to https://xbow.com/blog/xbow-built-a-chrome-full-chain-exploit
Comment linking /blog/xbow-built-a-chrome-full-chain-exploit
on “Zero to Calc in Six Days: Inside XBOW's Chrome Full Chain”Submitted No Time to Pwn – Can AI Find and Exploit the Linux Kernel? as a story · 4 points
HN discussionAgain, the XBOW article is pretty relevant: https://xbow.com/blog/mythos-offensive-security-xbow-evaluat...
Comment linking /blog/mythos-offensive-security-xbow-evaluation
on “Project Glasswing: An Initial Update”Submitted Dead.letter (CVE-2026-45185) Humans vs. LLM for Unauthenticated RCE Race on Exim as a story · 4 points
HN discussionyou would likely be quite interested in the more quantitative writeup from a real research team ! it’s linked about midway in to the article - similar functionally can be reached, yes, but not always and never with fewer tokens than what mythos requires. https://xbow.com/blog/mythos-offensive-security-xbow-evaluat...
Comment linking /blog/mythos-offensive-security-xbow-evaluation
on “Project Glasswing: An Initial Update”Submitted GPT-5.5: Mythos-Like Hacking, Open to All as a story · 4 points
HN discussionI think it's worth to look at the recent XBOW benchmark: https://xbow.com/blog/mythos-offensive-security-xbow-evaluat... they realized that ChatGPT 5.5 works better so the secret is in the architecture (including humans in the loop).
Comment linking /blog/mythos-offensive-security-xbow-evaluation
on “First public macOS kernel memory corruption exploit on Apple M5”Submitted Finding a Critical Vulnerability in Scoold with AI as a story · 4 points
HN discussionWhile it's great to clarify, LLMs are actually finding bugs and writing exploits [1][2]. There are more example though. [1] https://news.ycombinator.com/item?id=47589227 [2] https://xbow.com/
Comment linking /
on “Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)”Submitted AI now matches the capabilities of a top human pentester as a story · 4 points
HN discussionIn the last few days I was recommending to read the insights from XBOW [1], it's a competitor but it adds more information to the discussion. [1] https://xbow.com/blog/mythos-offensive-security-xbow-evaluat...
Comment linking /blog/mythos-offensive-security-xbow-evaluation
on “Project Glasswing: what Mythos showed us”Submitted Agents Found Three RCEs as SYSTEM (and root) on Bing Image Search as a story · 3 points
HN discussionBoth are true, the difference is the skill level of the people who use / create programs to coordinate LLMs to generate those reports. The AI slop you see on curl's bug bounty program[1] (mostly) comes from people who are not hackers in the first place. In the contrary persons like the author are obviously skilled in security research and will definitely send valid bugs. Same can be said for people in my space who d…
Comment linking /about
on “On The Coming Industrialisation of Exploit Generation with LLMs”Submitted XBOW Battles Ninja Tables as a story · 3 points
HN discussionI know that XBOW is working on offensive security using LLMs [1]. Backed by Sequoia Capital. [1] https://xbow.com/
Comment linking /
on a deleted threadSubmitted XML External Entity (XXE) Injection in Akamai CloudTest as a story · 3 points
HN discussion
