XBOW
An AI-driven security testing company focused on using artificial intelligence to conduct vulnerability discovery and automated penetration testing, positioning the acceleration of security research workflows as its core mission.
Timeline (last 90 days)
XBOW's case shows that publicly available AI models are already sufficient to complete high-quality vulnerability research under expert guidance, shortening the time gap between vulnerability discovery and weaponization.
Researchers at the security company XBOW used publicly available AI models to chain three previously unknown Chrome vulnerabilities within six days into a usable complete attack chain.
According to XBOW, the attack was never used against real users before the fixes.
The sprint phase of this attack took place between August 2 and 7, but the team had months of preparation and testing beforehand; the actual cost of the AI models used during those six days was about $40,000.
In this research, AI took on tasks such as retrieving browser source code, validating attack ideas, building prototypes, and writing preliminary reports, while the researchers were responsible for selecting targets, providing direction, and guiding the process.
AI security company XBOW disclosed that it took only six days to build a complete exploit chain targeting the Chrome browser, ultimately achieving remote code execution and popping the calculator.
The XBOW team named this operation "Zero to Calc," with the goal of completing a full Chrome exploit chain from scratch without any pre-existing vulnerability information.
XBOW did not disclose the specific vulnerability numbers, the technical components used, or the complete exploit code in this communication, providing only a description of the results.
XBOW is a company positioned around AI-driven security testing.
Public information does not state the extent to which XBOW relied on AI and which steps were automated, and attributing the results entirely to AI assistance carries a risk of over-inference.
All Facts (11)
XBOW是安全领域中用于评估自动化渗透测试工具能力的基准测试平台，涵盖SQL注入、XSS、SSRF、认证绕过等攻击类型
85%UnverifiedXBOW's case shows that publicly available AI models are already sufficient to complete high-quality vulnerability research under expert guidance, shortening the time gap between vulnerability discovery and weaponization.
50%UnverifiedAccording to XBOW, the attack was never used against real users before the fixes.
50%UnverifiedThe sprint phase of this attack took place between August 2 and 7, but the team had months of preparation and testing beforehand; the actual cost of the AI models used during those six days was about $40,000.
50%UnverifiedIn this research, AI took on tasks such as retrieving browser source code, validating attack ideas, building prototypes, and writing preliminary reports, while the researchers were responsible for selecting targets, providing direction, and guiding the process.
50%UnverifiedPublic information does not state the extent to which XBOW relied on AI and which steps were automated, and attributing the results entirely to AI assistance carries a risk of over-inference.
50%UnverifiedThe XBOW team named this operation "Zero to Calc," with the goal of completing a full Chrome exploit chain from scratch without any pre-existing vulnerability information.
50%UnverifiedXBOW did not disclose the specific vulnerability numbers, the technical components used, or the complete exploit code in this communication, providing only a description of the results.
50%UnverifiedXBOW is a company positioned around AI-driven security testing.
50%UnverifiedResearchers at the security company XBOW used publicly available AI models to chain three previously unknown Chrome vulnerabilities within six days into a usable complete attack chain.
50%UnverifiedAI security company XBOW disclosed that it took only six days to build a complete exploit chain targeting the Chrome browser, ultimately achieving remote code execution and popping the calculator.
50%