How we chained three vulnerabilities into a full Chrome exploit in just 6 days—claiming Google’s first $250,000 full-chain reward of 2026 for an attack affecting an estimated 1 billion users. 🧵

Which AI model gives you the most web exploits for your money?

We tested Claude Mythos 5.1 and OpenAI's GPT-6 lineup with @Xbow on 65 vulnerable open-source web apps (RCE, XSS, SSRF, SQLi and more).

Here is what the data says: 🧵

Great read from the @Xbow research team

> It also highlights that the ability to solve the hardest problems and the ability to solve many problems cheaply are different capabilities. A defender conducting a comprehensive assessment might want a model capable of pursuing complicated attack paths over a long period. But an attacker opportunistically searching for vulnerable systems may care much more about the number of promising targets they can investigate for a fixed cost.

Once again the asymmetry between attackers and defenders shows up, because defenders need the best and most expensive models to cover the whole system while an attacker can cheaply poke at every possible hole until one of them works.

xbow.com/blog/top-ai-mo…

Is OpenAI’s new GPT-6 Cyber better than GPT-6.1 Sol at hacking web apps?

We tested it with @Xbow on 65 vulnerable open-source apps (RCE, XSS, SSRF, SQLi and more).

Here’s what we found: 🧵

The best model for offensive security depends on how much you're willing to spend. A thread on our latest AI frontier model evaluations 🧵

5/ The best model changes with your budget

Read more: xbow.com/blog/top-ai-mo…

When AI can find every vulnerability, counting findings just measures noise. 📉

Security is about validated risk reduction, not bug counts.

Read Platinum Sponsor @Xbow's take on modern AppSec metrics.

🔗xbow.com/whitepapers/ai…

Thanks for your support!

#Cybersecurity #AI

1/ We are doing it totally wrong with vulns.
In my new post I dig into @googlechrome’s vuln data to show that the AI-driven Vulnpocalypse settled a 20-year-old debate: vulnerabilities are dense. Our defenses are still built as if they were sparse.

medium.com/@TalBeerySec/d…

Hear from @_remot3 -- who led the building of the #php2shell exploit for XBOW -- in the latest episode of Offense Taken with @fede_k 🐘

youtube.com/watch?v=akGDXh…

AI-generated code is accelerating, but security testing struggles to keep pace. @Xbow's Niroshan Rajadurai and @massmutual's Sridhar Boddula discuss how leaders can prioritise cyber risks and govern autonomous testing.

zurl.co/r7y4I #Cybersecurity #AI

AI offensive security surged in 1H 2026. XBOW tested GPT-5.5, Opus 4.7, Mythos Preview & Grok 4.5.

xbow.com/whitepapers/mi…

Thanks for supporting the Village as Platinum Sponsor, @Xbow! 🙏

#AISecurity #Pentesting #Cybersecurity #InfoSec

For years, we’ve been over-indexing on zero-days, while most cyberattacks were exploiting much simpler things: misconfigurations, weak credentials, and other low-hanging fruit.

And there’s a pretty simple reason for that: attacker ROI.

Attackers invest time, money, infrastructure, and skills, and they expect something in return. For a long time, going after the easy stuff was simply more profitable than spending months hunting for sophisticated vulnerabilities.
But LLMs are changing that equation.
The time, cost, and skills required to find vulnerabilities and build exploits are dropping dramatically. Today, turning a published CVE into a working exploit, plugging it into a scanner, and testing it across the internet can take just a few hours and a handful of tokens.
Suddenly, zero-days are becoming a much more attractive investment for attackers. The economics are shifting, and the gap between vulnerability disclosure and widespread exploitation is getting smaller.
And as I mentioned during my keynote at Off By One:
Patching is not a strategy anymore.

One of the questions we’ve gotten most: How did it cost $40,000 in GPT-5.6-sol usage to build a full-chain Chrome exploit?

@moyix breaks down exactly where that $40K went:

Read more about how we went from zero to calc in 6 days: xbow.com/labs/research/…

capo de @fede_k te explica este porque hay un incidente grande de ciberseguridad por día

algo sabe, ahora esta en @Xbow haciendo agentes para encontrar vulnerabilidades

ps: esto recién empieza

RT @darkfloyd1014: Nice to meet you, @oegerikus, we discuss a bit over maintaining stability in deterministic results.

@offensive_con htt…