We won the @Hacker0x01 Ambassadors World Cup for second time. 🏆
🧵 This is thread about my journey, and how it all started 8 months ago when I had 0 points on HackerOne ⬇️
A newly disclosed Exim vulnerability, CVE-2026-45185 (“Dead.Letter”), highlights how a flaw in handling SMTP BDAT commands and TLS connection termination could create serious security risks in widely deployed email infrastructure.
As covered by Ravie Lakshmanan in @TheHackersNews, the vulnerability was discovered and responsibly reported by XBOW.
The flaw affects GnuTLS-based Exim builds and could enable heap corruption and potential remote code execution through BDAT message handling during TLS shutdown. Research like this reflects the depth of analysis required to uncover high-impact vulnerabilities before attackers do.
Read the full article: https://t.co/iFSHbaAo9I
Anthropic’s Mythos raised the bar for AI vuln detection but kept it invite-only.
GPT-5.5 is OpenAI’s answer, and it’s open to all.
We had early access. Ran the benchmarks. Blackbox GPT-5.5 already beats whitebox GPT-5.
Best pentesting model we’ve tested.
Read our analysis: https://t.co/Xlh1iQVu3e
There are many problems that "autonomous pentesters" creators won't tell you because it's a hot niche that draws attention. But what sets a real autonomous system apart from bs is the middleware and all the connectors that are able to make sense of random agent behaviour.
Everyday I read about a new autonomous pentesting tools being released. All of them follow the same pattern. Some sort of agentic architecture with hacking tools connected and benchmarked against a vulnerable app.
Let me explain you why these systems are useless 👇
4. Without validation you will drain in noise.
5. Most of these tools delegate auth on the agent gambling if the test will pass it or not. Also multi-agent systems will kill eachother sessions while testing in parallel
Most IDORs aren’t “guess the next number.” They hide in real authorization logic.
In our latest Tales from the Trace, XBOW uncovered two zero-day IDORs by reasoning through the app like a pentester, even after 403s and 502s.
The future of DAST lies in autonomous reasoning, catching the real-world access control failures scanners miss (and attackers look for): https://t.co/2I7tPV6Fpd
Hate when I am deep down on a bug after researching it for days thinking I'm a genius for reversing it just to discover another asset that reveals the entire internals
@stokfredrik Worst thing is that models being black boxes and being trained on user supplied data, the likelihood of random data being exposed is more than expected
@phth0nus@zseano It won't die, there are many things that AI can't find same as there are many things you can't automate. What AI will do is help hunters have more coverage and optimize workflows. XBOW and similar will cover one part of the spectrum same as nuclei does.