remot3

ethical.hacker | bug.bounty.hunter

[remot3 @_remot3]

We won the @Hacker0x01 Ambassadors World Cup for second time. 🏆

🧵 This is thread about my journey, and how it all started 8 months ago when I had 0 points on HackerOne ⬇️

[XBOW @Xbow]

A newly disclosed Exim vulnerability, CVE-2026-45185 (“Dead.Letter”), highlights how a flaw in handling SMTP BDAT commands and TLS connection termination could create serious security risks in widely deployed email infrastructure.

As covered by Ravie Lakshmanan in @TheHackersNews, the vulnerability was discovered and responsibly reported by XBOW.

The flaw affects GnuTLS-based Exim builds and could enable heap corruption and potential remote code execution through BDAT message handling during TLS shutdown. Research like this reflects the depth of analysis required to uncover high-impact vulnerabilities before attackers do.

Read the full article: https://t.co/iFSHbaAo9I

[remot3 @_remot3]

@thedawgyg @nmatt0 Agree with this, Codex is better for adversarial validation/improvement but I find Claude better at finding bugs autonomously

[XBOW @Xbow]

Anthropic’s Mythos raised the bar for AI vuln detection but kept it invite-only.

GPT-5.5 is OpenAI’s answer, and it’s open to all.

We had early access. Ran the benchmarks. Blackbox GPT-5.5 already beats whitebox GPT-5.

Best pentesting model we’ve tested.

Read our analysis: https://t.co/Xlh1iQVu3e

[remot3 @_remot3]

There are many problems that "autonomous pentesters" creators won't tell you because it's a hot niche that draws attention. But what sets a real autonomous system apart from bs is the middleware and all the connectors that are able to make sense of random agent behaviour.

[remot3 @_remot3]

Everyday I read about a new autonomous pentesting tools being released. All of them follow the same pattern. Some sort of agentic architecture with hacking tools connected and benchmarked against a vulnerable app.

Let me explain you why these systems are useless 👇

[remot3 @_remot3]

4. Without validation you will drain in noise.

5. Most of these tools delegate auth on the agent gambling if the test will pass it or not. Also multi-agent systems will kill eachother sessions while testing in parallel

[remot3 @_remot3]

Back on top of the leaderboard for another year at @RootedCON x @intigriti hackernight!

[remot3 @_remot3]

@Haw_keye0 @CristiVlad25 AI can find business logic flaws as long as you provide a good context or the tools to allocate the context.

[XBOW @Xbow]

Most IDORs aren’t “guess the next number.” They hide in real authorization logic.

In our latest Tales from the Trace, XBOW uncovered two zero-day IDORs by reasoning through the app like a pentester, even after 403s and 502s.

The future of DAST lies in autonomous reasoning, catching the real-world access control failures scanners miss (and attackers look for): https://t.co/2I7tPV6Fpd

[remot3 @_remot3]

Hate when I am deep down on a bug after researching it for days thinking I'm a genius for reversing it just to discover another asset that reveals the entire internals

[remot3 @_remot3]

@rez0__ Is there any difference/advantage between using this and the Playwright MCP?

[remot3 @_remot3]

@corraldev @Hacker0x01 @okx Well deserved congrats 🎉

[remot3 @_remot3]

@rez0__ A way of making a 6$ coffee a 8$ coffee 😂

[remot3 @_remot3]

@stokfredrik Worst thing is that models being black boxes and being trained on user supplied data, the likelihood of random data being exposed is more than expected

[hipotermia @hipotermia]

Thanks to everyone who joined us at the @Hacker0x01 Brand Ambassadors Speed Show&Tell in Madrid, and special thanks to all who presented! 💕

[remot3 @_remot3]

@hipotermia @Hacker0x01 It was a blast, I am still recovering from the post-event

[remot3 @_remot3]

@phth0nus @zseano It won't die, there are many things that AI can't find same as there are many things you can't automate. What AI will do is help hunters have more coverage and optimize workflows. XBOW and similar will cover one part of the spectrum same as nuclei does.

[remot3 @_remot3]

@zseano This is not even close to XBOW, CAI is a base framework to develop agents but by default it won't find any interesting bug.