XBOW

The autonomous offensive security company redefining cyber defense for the AI era.

[XBOW @Xbow]

How we chained three vulnerabilities into a full Chrome exploit in just 6 days—claiming Google’s first $250,000 full-chain reward of 2026 for an attack affecting an estimated 1 billion users. 🧵

[XBOW @Xbow]

PHP2Shell just showed us how quickly defenders need to act. What should they be most worried about? 🫨

[Oege de Moor @oegerikus]

This will be an interesting session!

[XBOW @Xbow]

PHP2Shell: just another critical vulnerability but on a much faster clock...

AI didn’t make PHP vulnerable. It changed the economics of finding and exploiting the bugs already there.

@fede_k breaks down what happened and the shrinking window for defenders: https://t.co/xTMa614CvE

[Federico Kirschbaum @fede_k]

The abundance of RCE in these days, remind me the 2000. Exploits were shared, traded but also kept private, some lived for years.

[CyberDefenseMagazine @cyberdefensemag]

🏆Huge congratulations to @Xbow on winning Top Infosec Innovators at Cyber Defense Con 2026! Your bold vision, relentless innovation, and game-changing impact are redefining cyber resilience. Truly well-deserved. The industry is stronger with you! #CDCon2026 #CDMAwards

[XBOW @Xbow]

We're doing an AMA on Reddit with @moyix!

Drop your questions in the reddit thread + he'll answer live tomorrow, Thursday, 10/22 from 12-1pm ET. 🤓
https://t.co/w67GTWISZY

[Federico Kirschbaum @fede_k]

Looking for tips in building your hackbot? Catch this new episode of Offense Taken with @Jhaddix

[Rob T. Lee @robtlee]

Come train alongside your security peers at the SANS Institute AI Cybersecurity Summit. Our registrants are from banks, hospitals, utilities, manufacturers, technology companies and government agencies, and we're all back in boot camp!

These are people you can learn with, talk through a problem with, and call after the conference.

We’ve set aside two afternoons for six hands-on workshops. Pick two:

AI incident response:
Practice responding to compromised AI workloads with Steve de Vera (AWS) and Kyle Shields, CISM, GCIH, GCPN (AWS).

AI swarms:
Investigate intrusions involving multiple AI agents with @joswr1ght (CounterHack).

Offensive AI:
Use AI to exploit vulnerable applications with Andy Dennis and and William Reyor (@Xbow)

Delegating to agents:
Practice assigning security work to agents while retaining control with @lennyzeltser (SANS Institute).

AI pentesting:
Practice AI-assisted penetration testing with @pedramamini (OPSWAT) and Adrian Wood (Dropbox / BT6).

Autonomous DFIR:
Work with Caleb Evans (Airbyte) and Mulder, his winning Find Evil! incident-response agent.

Registration closes SOON for @SANSInstitute AI Cybersecurity Summit

See you in Arlington, VA (Select Summit talks are also available live online.) Registration includes virtual access to @unpromptedconf II

https://t.co/UQY9OpDOx4

[XBOW @Xbow]

What happens when autonomous agents start hacking for real?

@fede_k + @Jhaddix share their predictions in this episode of OFFENSE TAKEN 🔮

https://t.co/mNglodkyyP

[cje @caseyjohnellis]

Woot! the @unpromptedau talks are starting to coming come online! 👀

This one by @moyix was probably my favorite: 15mins of unadulterated old-school “I’m hacking this because I think I can” followed by a one-shot live exploit demo involving a t-shirt with a cat on it worn by @mdowd. Seriously just go watch it

(and subscribe for the others… More on the way!)

Watch Brendan Dolan-Gavitt: Security Through Obscurity Is Dead and LLMs Killed It https://t.co/z5Nkp2qMAJ

[JS0N Haddix @Jhaddix]

We are always so grateful for our sponsor, @Xbow!

XBOW Built a Chrome Full-Chain Exploit Affecting a Billion Users in Six Days

XBOW researchers and GPT-5.6 Sol discovered and built a Chrome full-chain exploit in less than a week, showing how an attacker could use Chrome to remotely take over a Windows machine.

The breakthrough highlights how the cost and time of finding serious vulnerabilities are falling fast, for attackers and defenders alike.

Get details on the exploit and what it means.
https://t.co/E6dHAtmIwG

[Apoorv Agrawal @apoorv03]

Thanks for the shoutout @Jason

Yes it’s true: a full Chrome exploit was achieved by just 1 researcher + @Xbow ’s AI agents in 6 days with ~$40K of compute! 1B+ users protected, all patched✌️

The takeaway is that elite cyber defense (and offense) is now compute-bound, not talent-bound. Annual security reviews and pen tests can't keep up when software is being updated real-time! XBOW like autonomous white-hat should be mandatory part of your security stack!

Ensure your (digital) doors and windows are locked!

[TBPN @tbpn]

We’re back with:

- @EliManning (NFL)
- @nealstephenson (Author)
- @michaelwaldron (Hulu)
- @GuptaRK22 & @johnwhegeman (Ithaca)
- @AnjneyMidha (AMP PBC)
- @jacksdiningroom (Yes Chef)
- @oegerikus (XBOW)
- @jeffholden (Atomic Machines)
- William Chu (Zurich)
- Nick Talken (Albert)

[XBOW @Xbow]

Read the full write up: https://t.co/Pxj0YYPehF

[XBOW @Xbow]

ICYMI: We found a full chain Google Chrome exploit in just 6 days that affected a billion users. Here are 4 things we learned. 🧵

[XBOW @Xbow]

4/ 6 days and $40k is not a lot of time or money when the payoff is a Chrome chain! This does *not* mean anyone can get a Chrome chain given that time and money—we applied a fair bit of our own human expertise and judgment—but the bar is *significantly* lower. Defend accordingly!

[XBOW @Xbow]

POV: you’re gpt-5.6-sol when the Chrome full-chain exploit was built 🫨