Alvaro Muñoz

Security Researcher with @XBOW. CTF #int3pids. Opinions here are mine! bluesky:

[XBOW @Xbow]

“For us, the most important part isn't just finding the bug; it's that you understand why we found it, how we found it, and how we exploit it,” says XBOW head of security labs @fede_k in a recent episode of Security Conversations with @ryanaraine @juanandres_gs.

Hear more in the clip below.

Watch the full episode here: https://t.co/vkoTSmrnAc

[XBOW @Xbow]

Finding IDORs with automation is hard. Most tools stop at "Can I access this?". XBOW had to answer, "Should I be able to?" Here’s how we did it. https://t.co/ihnS3HOGkS

[Oege de Moor @oegerikus]

I just love working with @ca0s_! He brings deep offensive security expertise, incredible creativity, fearsome developer skills, and great taste.

This work on scoping @XBOW pentests is a perfect example of the craft, care, and ingenuity he brings to the team every day.

[Alvaro Muñoz @pwntester]

@SinSinology @chudyPB @olekmirosh @steventseeley @irsdl @tiraniddo @frycos @mwulftange It was great to meet! I feel honored our work was useful and inspiring to you. Keep up the awesome work!

[SinSinology @SinSinology]

guess what? there's like 50 deserialization gadgets in this picture! you don't always get to hangout with @pwntester and @chudyPB 🔥👑
we're missing @olekmirosh @steventseeley @irsdl @tiraniddo @frycos @mwulftange

[Niemand @niemand_sec]

This is not our talk, DEFCON screens didn't work during our time slot. We recorded and uploaded the full talk ourselves.

Our talk: https://t.co/bBKCRbx8Dl

[XBOW @Xbow]

Security tools catch issues. But do they matter?

Join @GeekMasher + @pwntester with @GitHub tomorrow as they show how AI agents: 

→ Exploit like experts
→ Ship findings in minutes
→ Validate vulns scanners miss

🗓️Live @ 11:15am PT | 2:15pm ET https://t.co/u9l03t749R

[Piotr Bazydło @chudyPB]

Fun times with Telerik UI and DoS by default (it will hit for a long time I think). Sometimes it may lead to more fun, like RCE :)
Gadgeting inspired by @pwntester, Oleksandr and @steventseeley

[djurado @djurado9]

Do not miss this live session from my teammates @moyix and @pwntester. Today, 10 am PT/ 1pm ET.

You will learn about:
- AI agents validating real vulnerabilities at scale
- How can AI agents autonomously uncover and validate exploits using runtime behaviors
- Techniques for minimize hallucinations

Last chance to join! 🎉

[Alvaro Muñoz @pwntester]

When I read the trace for this bug it reminded me of the almost identical finding by @artsploit in Datahub https://t.co/3cfstyopfC

[XBOW @Xbow]

XBOW found a new zero-day in Apache Druid. It wasn't just a lucky guess.

XBOW is trained to think like a human attacker, using historical CVE knowledge to find a novel SSRF (CVE-2025-27888). This is how AI-powered pentesting turns old knowledge into new findings.

Read the write-up: https://t.co/AsqA4OpziO

#Cybersecurity #InfoSec #Hacking #AI #ApacheDruid

[Alvaro Muñoz @pwntester]

Join @moyix and yours truly in a fireside chat about all things @Xbow and our validators. If you haven’t registered yet, secure your seat here: https://t.co/InSQS9fITz More info at: https://t.co/4dNrPHwE1z

[XBOW @Xbow]

200+ real vulns. 0 false positives.

XBOW agents ran autonomous exploits across Docker Hub webapps, and uncovered vulnerabilities traditional tools miss.

Systematic. Validated. No assumptions.

🗓️ This Thurs — @moyix + @pwntester lead a live breakdown

https://t.co/Wztoo32YGs

[Adnan Khan @adnanthekhan]

GitHub even offers a built in suite of CodeQL detections for Actions that @pwntester wrote that easily catch things like those. Yet we still see the most obvious misconfigurations with critical impact. Vibe coding actions will get you wrecked.

[Adnan Khan @adnanthekhan]

What a PR https://t.co/zdMt9Ilq4r by @NxDevTools

This one was written by AI and introduces a critical PR title injection that could allow anyone to steal their NPM token with a little privesc.

How is stuff like this still shipping?

[Daryl @daryl_imagineai]

@moyix Dutch saying: Tall trees catch a lot of wind.
Congrats, xbow is a tall tree :)

[Alvaro Muñoz @pwntester]

Back at summer hacker camp, it’s been a while! Will be at @Xbow booth (3257) all morning. Come say hi!

[XBOW @Xbow]

🚀 Excited to announce our partnership with @TrustVanta !

With XBOW’s autonomous penetration testing now in Vanta, startups can meet the highest security standards with speed and confidence—finding and validating real vulnerabilities in hours, not weeks.

Learn more: https://t.co/SIJMtlg2xY
Watch the preview: https://t.co/YFaOi6vfKA

[djurado @djurado9]

The new episode of @ctbbpodcast is out! Huge thanks to @Rhynorater and @rez0__ for having me. I had a great time chatting with you about XBOW and HackerOne’s Ambassador World Cup. It was a blast! 🫶����

[Nico Waisman @nicowaisman]

If you have some time today, check out @moyix highlights or @pwntester full blogpot on this amazing vulnerability and how it was exploited by XBOW.

See you all in BH/Defcon next week!

[Oege de Moor @oegerikus]

Ingenious. A gripping detective story, with the plot devised by @XBOW, and told by @pwntester.