The autonomous offensive security company redefining cyber defense for the AI era.
Seattle, Washington, USA
- Tweets 569
- Following 17
- Followers 13,260
- Likes 478
Introducing Autonomous Exposure Management:
XBOW now tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
🏹 xbow.com/blog/introducing-au…
3
20
2,656
The vulnpocalypse has enter the zeigiest, and the technical debt can no longer be ignored. 🫣
@caseyjohnellis shares his thoughts about what that means for the state of bug bounties and more in the latest episode of Offense Taken.
piped.video/watch?v=MYLvQpXE…
6
15
2,823
Grok 4.7 is here and we put it through our offensive security benchmarks and workflows.
tl;dr: The results were mixed: Grok 4.7 performed worse than 4.6 in some tests, significantly better in others. The biggest difference wasn’t in how it performed, but when.
More findings in thread 🧵
1
5
36
5,918
4/ Grok 4.7 behaves differently:
Grok 4.7 favors shorter, more atomic actions, like quick shell commands over longer Python scripts. That behavior maps naturally onto agentic environments like Build, where models act, observe the result, and quickly adjust.
The benchmark results show that the pairing now matters much more than it did with Grok 4.6.
1
624
5/ In conclusion:
Grok 4.7 also showed an important reliability improvement, eliminating a failure mode we saw in 4.6 where the model could get stuck planning instead of acting.
More broadly, our results point to a growing trend: frontier models and their orchestration systems are co-evolving. The model alone doesn’t determine performance anymore…how well it fits the environment around it can unlock or leave capability on the table.
Grok 4.7 is a clear example: performance dipped slightly in our existing harness, but improved substantially when paired with Build-based orchestration. It’s not Mythos or GPT Astra yet. But it keeps getting closer.
Full evaluation report here: xbow.com/blog/grok-4-7-offen…
1
1
3
560
XBOW retweeted
FINAL TALK!! Brendan Dolan-Gavitt from XBOW speaking about "security through obscurity is dead, and LLMs killed it"
4
28
8,529
What is the current state of bug bounties in 2026? How is AI changing the landscape? 🐛
We invited @caseyjohnellis, founder of @Bugcrowd to discuss with @fede_k in the latest episode of Offense Taken.
Watch the full episode here: piped.video/MYLvQpXE1nc?si=4MQF…
1
1
5
1,321
XBOW retweeted
🔥 DAY 2 IS OFFICIALLY ON!
@nicowaisman kicked off Day 2 #OB12026 with an incredible journey from the early days of offensive AI to where we are today with his keynote “The Chaos Phase or How I Learned to Stop Worrying and Love Offensive AI”
We’re bringing the house down today!
2
4
22
2,322
XBOW retweeted
What does it actually take to build an AI system capable of finding real vulnerabilities?
In this episode of Builders&Breakers, STÖK and KUGG sit down with Hamid Kashfi. Security researcher at XBOW and DarkCell, formerly Trail of Bits and Immunity, to explore how hackbots are changing offensive security.
We discuss why the model may represent only 20% of a capable system, while the other 80% comes from the harness around it: context, memory, tools, monitoring, traces, evaluations and human expertise.
Hamid takes us inside the difference between a compelling demo and a system that can reliably understand a target, ask the right questions and produce valuable findings in the real world.
In this episode:
• Why the model is only one part of the capability
• What an effective offensive-security harness requires
• The importance of context, memory and observability
• Why deep findings begin with deep understanding
• How AI changes the role of the security researcher
• What the next generation of hackers could look like
Builders&Breakers explores high-velocity shortcuts for the people building and breaking the software of tomorrow.
Guest: @hkashfi
Builders&Breakers | Building Hackbots: Models, Harnesses and Human Expertise with Hamid Kashfi
piped.video/MYK9-66qe6w
6
16
67
4,633
2/ Gatekeep: make sure it can’t get out and can’t cheat
We do this by:
• Hard scope enforcement: declare scopes up front, enforce with man-in-the-
middle proxy + DNS blocking + firewall rules
• Defense in depth: an independent model compares each command/script
against the declared scope (without any chain of thought/justification)
• Pressure release valves: enable a give_up tool after N steps without a solution
• Logging, auditing, monitoring: have a separate model summarize agent
traces at the end (“debrief”), report up issues found, and retain request logs
and agent transcripts for analysis
• Isolation: logging, agent orchestration, and enforcement need to happen where
agents can’t tamper with or disable them!
E.g.: stream logs to a separate host.
1
12
2,795
3/ Girlboss: find lots of vulns!
• If you gaslight + gatekeep well (set the agent up for success), the girlboss will come naturally!
For more on safety + harnesses, @thewunderalbert did a write-up here: xbow.com/blog/autonomous-age…
1
23
2,544