XBOW

Headlines · 3

1. 3d
   XBOW used GPT-5.6 Sol to break Chrome's sandbox, earning a $250K Google bounty

   Security research team XBOW says it used OpenAI's GPT-5.6 Sol and other models, plus four researchers, to build a full-chain Chrome exploit and gain full system access in six days; it estimates the same work done entirely by humans would take about six months. The three flaws were reported to Google and have been fixed, with Google paying a $250,000 bounty, and XBOW says roughly 1 billion users were potentially affected. XBOW put its compute cost at about $40,000, with AI searching Chrome source code, testing ideas, building proof-of-concept code and drafting the initial exploit, while humans set strategy, chose research directions, reviewed the agents' output and adjusted their actions.

   IT之家 AI · 🔥 0
2. 6d
   Decepticon open-sources autonomous red-team agent, claims 98% on XBOW benchmark

   Decepticon is an open-source autonomous red-team agent from PurpleAILAB, published on GitHub under Apache-2.0 and available either self-hosted via Docker or through the project's cloud demo. Its documentation says it coordinates 16 specialist agents by kill-chain phase — reconnaissance, exploitation, privilege escalation, lateral movement and C2 — running commands in a Kali Linux sandbox on a separate operational network, and it can be registered as an MCP server for Claude Code or Codex. The README self-reports a 102/104 (98.08%) pass rate on the XBOW validation-benchmarks and lists support for Anthropic, OpenAI, Google Gemini, MiniMax, DeepSeek, xAI, Mistral, OpenRouter, Nvidia NIM and local Ollama models, plus subscription logins such as Claude Max and ChatGPT Pro.

   GitHub Trending · Python · 🔥 0
3. 7d
   CrowdStrike: Korean bank hacks used ARTEX AI pentest tool with DeepSeek and Claude Code

   CrowdStrike reported on 7 October that an attack campaign against South Korean financial institutions used the AI penetration-testing tool ARTEX, with DeepSeek as its main model backend and Claude Code used alongside it. South Korean media reported data leaks at at least seven institutions including Shinhan Bank, KB Kookmin Bank and Hana Bank; roughly 25,000 Shinhan customers had names, phone numbers, annual income and loan limits exposed after attackers bypassed authentication to reach a loan-broker lookup service. ARTEX author Autumn-27 said on 8 October that the project was going closed-source with no further updates or support because of misuse, and the original GitHub repository became inaccessible, though hundreds of forks mean source backups and localized copies remain available online.

   虎嗅 AI · 🔥 0

Experience and discussion from the community

Share my XBOW experienceAsk about XBOW