PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Agents Built From Alloys

xbow.com | vulnerability | #ai-security | #agentic-ai | #benchmark | #research | #ai-pentesting | #alloy-agents | #solver
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

XBOW explains its Alloy Agents approach: composing specialized solvers lifted CTF-style challenge success from 25% to 55% on fixed benchmarks, with lessons beyond security.
Published
Collected

Related coverage

blog · netspi.com
Introducing EchoBench: A Human Calibrated Benchmark for Autonomous Pentesting
EchoBench is a human-calibrated benchmark for agentic AI web pentesting; a score of 100 marks parity with associate pentesters across fidelity, difficulty-reach, OWASP breadth, and repeatability.
blog · netspi.com
Anthropic’s Mythos Announcement: What it Means for Security Teams
A measured take on Anthropic's Mythos: autonomously chaining four vulnerabilities is a real inflection point, but teams should build their own benchmarks and keep human verification central.
vulnerability · xbow.com
Introducing XBOW
XBOW's founding manifesto: the AI pentester autonomously solves 75% of web security benchmarks (85% on its own novel set), with founder notes tracing the team from GitHub Copilot and Semmle.
vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
vulnerability · netspi.com
Exploiting a Generative AI Chatbot – Prompt Injection to Remote Code Execution (RCE)
NetSPI built a deliberately vulnerable LLM chatbot to demonstrate prompt injection risks. The walkthrough shows how injected prompts enable data disclosure and, with code execution features, RCE.
vulnerability · yokai.hakaisecurity.io
OsCommerce v4 RCE: Unveiling the file upload bypass threat
In my recent research, I identified a critical vulnerability in osCommerce v4, specifically a Remote Code Execution (RCE) vulnerability enabled by bypassing file upload restrictions. I’ve always enjoyed testing file upload bypass techniques in my assessments. Vulnerabilities Identified in OsCommerce Version 4 The CVE-2024-22724 was assigned to the discovery of this vulnerability. The issue […]
Back