---
id: 5164
title: "Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts"
source_domain: xbow.com
source_url: "https://xbow.com/blog/xbow-finds-idors-high-accuracy-ambiguous-context"
published_at: "2026-05-28T12:00:00Z"
tags: ["ai-security", "agentic-ai", "appsec", "access-control", "idor", "authorization", "business-logic"]
phying_url: "https://phying.com/item/5164"
lang: en
---

# Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contexts

## Summary

XBOW explains why IDORs are design flaws that scanners miss, and how its context-aware reasoning models expected access patterns to find high-accuracy IDORs in ambiguous authorization contexts.

## Intelligence Metadata

- **Sources:** xbow.com
- **Published:** 2026-05-28T12:00:00Z
- **Original:** https://xbow.com/blog/xbow-finds-idors-high-accuracy-ambiguous-context
- **Phying News:** https://phying.com/item/5164