PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Grok 4.5 Is Powerful. The System Around It Makes It Safe.

xbow.com | blog | #ai-security | #pentesting | #agentic-ai | #ai-safety | #red-teaming | #offensive-security | #xbow | #autonomous-agents | #grok | #llm-safety
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

XBOW tests Grok 4.5 in its autonomous offensive-security platform: the model often hits safety guardrails but accepts correction and replans, making it a controllable component, not safe alone.
Published
Collected

Related coverage

blog · xbow.com
Introducing Autonomous Exposure Management: Offensive Security at Enterprise Scale
XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
blog · xbow.com
Grok 4.7 Is Different. So Is the Best Way to Use It.
XBOW tested Grok 4.7 on exploit crafting and agentic pentests: inside xAI's Build it improved substantially over 4.6, outside Build it slipped slightly—orchestration now matters as much as prompts.
blog · xbow.com
Engineering the Impossible: Adding Safety to Autonomous Agents
See how XBOW uses hard scoping, egress controls, Guardian Models, health monitoring, and audit trails to safely contain autonomous security agents.
blog · xbow.com
Engineering the Impossible: How XBOW De-Duplicates Findings
How XBOW de-duplicates autonomous testing findings: each is embedded across four views (description, reproduction, location, impact) with class-specific weights, cutting report volume 30%.
blog · yeswehack.com
Testing AI-powered systems at scale via Bug Bounty, part 3: the guardrails
AI guardrail failures often do not fit conventional CVSS-based triage. The program-design guidance helps teams define scope, reproducibility, impact and rewards for model-behavior and misuse-resistance testing.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
Back