←back to thread

XBOW, an autonomous penetration tester, has reached the top spot on HackerOne

(xbow.com)
283 points summarity | 1 comments | 24 Jun 25 15:53 UTC | HN request time: 0s | source
Show context
bgwalter ◴[24 Jun 25 18:42 UTC] No.44369396[source]▶
"XBOW is an enterprise solution. If your company would like a demo, email us at info@xbow.com."

Like any "AI" article, this is an ad.

If you are willing to tolerate a high false positive rate, you can as well use Rational Purify or various analyzers.

replies(1): >>44369542 #
moyix ◴[24 Jun 25 18:52 UTC] No.44369542[source]▶
You should come to my upcoming BlackHat talk on how we did this while avoiding false positives :D

https://www.blackhat.com/us-25/briefings/schedule/#ai-agents...

replies(2): >>44369750 #>>44378384 #
tptacek ◴[24 Jun 25 19:05 UTC] No.44369750[source]▶
You should publish the paper quietly here (I'm a Black Hat reviewer, FWIW) so people can see where you're coming from.

I know you've been on HN for awhile, and that you're doing interesting stuff; HN just has a really intense immune system against vendor-y stuff.

replies(1): >>44369834 #
moyix ◴[24 Jun 25 19:12 UTC] No.44369834[source]▶
Yeah, it's been very strange being on the other side of that after 10 years in academia! But it's totally reasonable for people to be skeptical when there's a bunch of money sloshing around.

I'll see if I can get time to do a paper to accompany the BH talk. And hopefully the agent traces of individual vulns will also help.

replies(1): >>44369855 #
tptacek ◴[24 Jun 25 19:13 UTC] No.44369855[source]▶
J'accuse! You were required to do a paper for BH anyways! :)
replies(2): >>44369915 #>>44375979 #
1. leenify ◴[25 Jun 25 11:21 UTC] No.44375979{5}[source]▶
Hmm, is that really true? I spoke at BH last year and was not required to submit a paper. And based on the briefings link, there surely isn't a paper link, only slides and tool.