XBOW Autonomous AI Hacker Takes Top Global Spot on HackerOne

Sequoia Capital

Defenders face a six-to-nine-month window to deploy offensive AI tools before open-weight models grant malicious actors identical automated hacking capabilities.

AI-assisted summary of Inside the Rise of Autonomous AI Hackers: XBOW's Oege de Moor — original source. Check the original for full context.

Source published: 2026-05-06

Detailed notes

## Background Published on YouTube by Sequoia Capital on May 06, 2026, this video features Oege de Moor, the founder and CEO of XBOW, at the AI Ascent 2026 stage. The page description outlines how XBOW's autonomous AI hacker secured the top ranking on HackerOne in August 2025, discovered a critical vulnerability in Bing Image Search, and details a closing call to action regarding a tight six-to-nine-month window before open-weight models catch up.

## TL;DR The presentation highlights a major paradigm shift in cybersecurity toward autonomous AI hacking, where machines execute complete cyberattacks without human intervention. To demonstrate this capability, the speaker highlights how their tool, Xbo, discovered a critical Remote Code Execution vulnerability in Bing Image Search and dominated the global HackerOne leaderboard using pure black-box testing. By combining different AI models into powerful "alloys," these autonomous systems are drastically accelerating the threat landscape, shrinking the time between vulnerability discovery and active exploitation to a negative window. Ultimately, the industry is urged to adopt offensive AI tools for defense immediately, as open-weight models are expected to reach matching capabilities within six to nine months.

## Atmosphere & style The presentation carries an urgent, high-stakes, and cautionary tone, blending historical warrior parallels with cutting-edge technological warfare. The speaker delivers the insights with a compelling mix of authoritative expertise and proactive rallying, shifting away from apocalyptic doomsaying toward an intense call to action. It feels like a wake-up call from a knowledgeable peer, concluding with an evocative, grounded warning that emphasizes just how tight the defensive timeline has become.

## Key takeaways - [00:03](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=3s) Cybersecurity is shifting toward autonomous AI hacking where AI systems execute data breaches and vulnerability discoveries entirely without human assistance. - [00:03](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=3s) The rapid evolution of cybersecurity mimics historical technology shifts, establishing a paradigm where defenders and attackers who leverage AI will inevitably defeat those who do not. - [01:34](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=94s) XBOW's autonomous tool, Xbo, discovered a critical remote code execution (RCE) vulnerability in Microsoft's highly secured Bing Image Search using only the target URL. - [01:34](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=94s) Autonomous security audits can be executed rapidly and cost-effectively, with Xbo's Bing Image Search audit carrying a list price of only $3,000. - [02:32](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=152s) Xbo operates dynamically by sending out scout agents for reconnaissance, prioritizing promising endpoints, and launching targeted attack vectors. - [02:32](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=152s) Xbo proved the viability of autonomous hacking by becoming the #1 ranked hacker in the United States and subsequently the world on the HackerOne platform by August 2025. - [03:51](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=231s) Using a model 'alloy'—alternating queries between different foundational models like Claude Sonnet and Gemini—allows AI systems to self-correct and significantly improve attack performance. - [03:51](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=231s) The integration of next-generation frontier models like GPT-5 is estimated to make autonomous hacking systems three times more effective than the top human ethical hackers. - [05:19](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=319s) Black-box testing tools like Xbo offer a distinct advantage over white-box static code analysis because they prove actual exploitability and account for deployment or configuration errors. - [05:19](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=319s) The window between CVE publication and active exploitation has shrunk from over two years in 2018 to a negative timeline today, meaning vulnerabilities are regularly exploited before public disclosure. - [07:27](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=447s) Frontier AI labs must focus on maximizing the cyber capabilities of their models rather than delaying progress due to safety debates. - [07:27](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=447s) Defenders and organizations must adopt autonomous offensive AI tools to proactively discover and patch their own exploitable vulnerabilities. - [07:27](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=447s) The industry faces a narrow 6 to 9 month window before open-weight models reach the same capabilities as proprietary systems, making powerful automated hacking tools universally accessible to all actors.

## Detailed walkthrough ### [00:03](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=3s) The Dawn of Autonomous Hacking and the Battle of Nagashino

The speaker opens by referencing a well-known security breach of the Mexican government, where human hackers utilized OpenAI and Anthropic models as assistants to execute a massive data breach. However, the core focus of today's talk is not human-assisted AI hacking, but rather "autonomous hacking where the AI does all the work without any human assistance."

To contextualize the current state of cybersecurity, the speaker draws a historical parallel to the Battle of Nagashino in 1575 Japan. On one side was Oda Nobunaga, a minor upstart warlord who viewed warfare as a system to be optimized and equipped his army with the latest firearm technology. On the opposing side was the legendary Takeda clan, famous for an invincible cavalry and highly skilled, veteran warriors. Nobunaga's optimized, tech-forward approach secured a decisive victory. The speaker warns that cybersecurity is facing an identical paradigm shift: "Those with AI will win."

---

[01:34](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=94s) Finding a Critical Vulnerability in Bing Image Search

To demonstrate the power of autonomous hacking, the speaker highlights a critical vulnerability discovered just a couple of weeks prior. Microsoft announced a remote code execution (RCE) vulnerability in Bing Image Search—a system that is heavily secured by Microsoft's top engineers and constantly targeted by thousands of hackers worldwide. An RCE is the most dangerous type of vulnerability because it allows an attacker to run arbitrary code on the target system, resulting in a complete takeover.

This severe vulnerability was discovered autonomously by the speaker's company product, Xbo. Remarkably, the only input Xbo required to find it was the target URL. The list price cost for running this autonomous audit was just $3,000 (and even less for the company to run internally). The speaker emphasizes that the tool is fast, cheap, and incredibly effective.

- **Target:** Bing Image Search (highly secured, high-traffic Microsoft system) - **Vulnerability Type:** Remote Code Execution (RCE) / Complete takeover - **Input Required:** Only the target URL (pure black-box testing) - **Cost:** $3,000 list price

---

[02:32](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=152s) How Xbo Works and Dominating the HackerOne Leaderboard

Xbo operates much like a human hacker. It begins with reconnaissance, deploying "scout" agents to map out the attack surface. It then prioritizes the most promising and "juicy" endpoints before systematically launching relevant attack types. Despite such capabilities, many human security researchers remain highly skeptical that a machine can autonomously carry out these complex offensive tasks.

To counter this skepticism, the company entered Xbo into the HackerOne platform last year. HackerOne connects organizations with ethical hackers who find and report vulnerabilities in exchange for cash bounties and leaderboard points. Operating entirely via black-box testing with only a URL, Xbo rapidly climbed the ranks. Within a few weeks, it became the number one ranked hacker in the United States, and by August, it secured the spot as the number one hacker in the world.

- **Reconnaissance Phase:** Sends out scout agents to discover the attack surface. - **Prioritization Phase:** Identifies the most promising endpoints. - **Execution Phase:** Deploys targeted, relevant attack vectors. - **HackerOne Achievement:** Reached #1 in the US and #1 in the world by August, using purely autonomous black-box testing.

---

[03:51](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=231s) Model Progression, "Alloys," and the Impact of GPT-5

The foundation models powering Xbo have progressed rapidly since its August leaderboard victory. Testing on a suite of open-source, real-world web applications—which the speaker notes are "not some Mickey Mouse cyber benchmarks"—shows a steep upward trajectory. When Xbo topped the HackerOne leaderboard, it was running on an "alloy" of Anthropic's Claude Sonnet and Google's Gemini.

The speaker explains that an "alloy" works by treating an attack as a sequence of actions. At each step, the system metaphorically flips a coin to decide whether to query Gemini or Sonnet. This collaborative approach functions like pair programming, allowing the models to compensate for each other's mistakes and perform significantly better than either model could individually. Shortly after Xbo took the top spot, GPT-5 was released. Extrapolating from its performance, the speaker estimates GPT-5 would have performed at least three times better than the best human hacker on HackerOne.

- **Alloy Methodology:** Alternating queries between different models (e.g., Sonnet and Gemini) at each step of an attack sequence to self-correct errors. - **Performance Leap:** GPT-5 integration is estimated to perform 3x better than the top human ethical hackers.

---

[05:19](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=319s) Black-Box vs. White-Box Testing and the Collapse of CVE Windows

The speaker compares Xbo's black-box approach to white-box tools like "MyChelle's," which analyze source code to find potential flaws. While white-box testing has the advantage of direct code access, real-world attackers rarely have this luxury. Furthermore, static code analysis cannot determine if a vulnerability is actually exploitable in the wild, what its actual impact is, or if the issue stems from deployment and configuration errors rather than the code itself. Xbo solves this by proving exploitability.

The urgency of this threat is highlighted by the collapsing timeline of vulnerability exploits. In 2018, the average delay between the public release of a Common Vulnerabilities and Exposures (CVE) notice and its active exploitation by bad actors was about two to two and a half years. Today, that window has "gone negative." For most CVEs, malicious actors are already actively exploiting the vulnerability before the official CVE is even published. Given this reality, the speaker finds it "incomprehensible" that traditional cybersecurity stocks drop whenever there is news about AI advancements, arguing that we need every AI-driven defense tool possible to counter these automated threats.

- **2018 CVE Exploitation Window:** ~2 to 2.5 years post-publication. - **Current CVE Exploitation Window:** Negative (exploited in the wild before public disclosure).

---

[07:27](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=447s) A Call to Action: The 6 to 9 Month Window

Moving away from "preaching like Nostradamus" about impending doom, the speaker rallies the audience to adopt the proactive spirit of Oda Nobunaga. He issues three urgent recommendations to the cybersecurity and AI communities. First, creators of frontier models must maximize their models' cyber capabilities without getting bogged down in safety debates, recognizing that we are in an active arms race. Second, human security researchers must be equipped with these autonomous tools to scale their defensive capabilities. Third, organizations must prioritize what matters by focusing on vulnerabilities that are proven to be exploitable.

The speaker warns that the defensive window is incredibly tight. Based on the current trajectory of software engineering agents, the industry has only about 6 to 9 months before open-weight models become just as capable as proprietary systems like MyChelle's. "If you want to have a nice Thanksgiving dinner with your family," the speaker concludes, "you better start fixing now."

## Notable quotes > [00:03](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=3s) autonomous hacking where the AI does all the work without any human assistance. — Oege de Moor

> [00:03](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=3s) Those with AI will win. — Oege de Moor

> [03:51](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=231s) not some Mickey Mouse cyber benchmarks — Oege de Moor

> [05:19](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=319s) gone negative — Oege de Moor

> [05:19](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=319s) incomprehensible — Oege de Moor

> [07:27](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=447s) preaching like Nostradamus — Oege de Moor

> [07:27](https://www.youtube.com/watch?v=eHsr1Fl2jNA&t=447s) If you want to have a nice Thanksgiving dinner with your family, you better start fixing now. — Oege de Moor

## Mentioned Oege de Moor, XBOW, Xbo, HackerOne, Bing Image Search, Microsoft, Oda Nobunaga, Takeda clan, OpenAI, Anthropic, Claude Sonnet, Google, Gemini, GPT-5, MyChelle's, Sequoia Capital

[Source](https://www.youtube.com/watch?v=eHsr1Fl2jNA)

中文简报

XBOW自主AI黑客荣登HackerOne全球榜首在开放权重模型赋予恶意攻击者同等自动化黑客能力之前，防御方仅有6至9个月的窗口期来部署进攻性AI工具。该演示指出，网络安全领域正迎来向自主AI黑客攻击的重大范式转变，即机器可在无需人工干预的情况下执行完整的网络攻击。为展示这一能力，演讲者强调了其工具Xbo如何仅凭纯黑盒测试，就在Bing Image Search中发现了一个严重的远程代码执行漏洞，并登顶全球HackerOne排行榜。通过将不同的AI模型组合成强大的“合金”，这些自主系统正大幅加速威胁态势的演变，将漏洞发现到被实际利用之间的时间压缩至负窗口期。最终，业界被敦促立即采用进攻性AI工具进行防御，因为预计开放权重模型将在6到9个月内具备同等能力。网络安全正全面转向由 AI 独立完成渗透与漏洞发现的自主黑客攻击时代，形成运用 AI 者必将战胜未运用者的技术范式。 (0:03) XBOW 旗下自主工具 Xbo 仅凭目标 URL 便在微软重度防御的必应图片搜索（Bing Image Search）中发现了关键的远程代码执行（RCE）漏洞，单次审计标价仅需 3,000 美元。 (1:34) Xbo 通过派出侦察代理、识别高价值端点并针对性攻击，于 2025 年 8 月成功登顶 HackerOne 全美及全球黑客排行榜第一。 (2:32) 通过交替调用 Claude Sonnet 和 Gemini 等基础模型构成“模型合金（alloy）”实现自我纠错，系统表现大幅提升；接入 GPT-5 后，其效能预计达到顶尖人类白帽黑客的 3 倍。 (3:51) 当前 CVE 漏洞被利用的窗口期已变为“负数”（公开前即遭利用）；预计开源权重模型在 6 至 9 个月内也将具备同等能力，防守方必须立即主动运用 AI 进行防御。 (6:28)

Reading summary

XBOW founder Oege de Moor argues that cybersecurity is undergoing a permanent transition toward fully autonomous AI offensive operations that execute without human intervention. Drawing a parallel to the 1575 Battle of Nagashino, he contends that automated, systematic approaches will inevitably outmatch traditional human expertise, requiring defenders to adopt autonomous tools before offensive capabilities proliferate. Autonomous Penetration Testing and Operational Validation (1:34) De Moor distinguishes autonomous hacking from human-assisted AI attacks, such as the breach of the Mexican government where attackers used commercial models merely as assistants. To prove that software can independently discover critical flaws, de Moor points to his company's tool, XBOW, which autonomously identified a remote code execution (RCE) vulnerability in Microsoft's Bing Image Search using only the target URL at a list price cost of $3,000. To counter industry skepticism, XBOW was deployed on the HackerOne bug bounty platform operating strictly via black-box testing. The system mimics human workflows across three phases: deploying scout agents for reconnaissance, prioritizing promising endpoints, and launching targeted attack vectors. Operating autonomously, XBOW reached the number-one hacker ranking in the United States and achieved the number-one global ranking by August. Multi-Model Alloys and Offensive Performance Scaling (3:51) XBOW's leaderboard benchmark was achieved using an 'alloy' architecture that combined Anthropic's Claude Sonnet and Google's Gemini. Rather than relying on a single engine, the system treats an attack as a sequential pipeline, querying either model interchangeably at each step. According to de Moor, this setup functions like pair programming, enabling the models to compensate for each other's individual errors and perform substantially better than either model could in isolation. Following that milestone, testing on real-world, open-source web application suites demonstrated continued rapid gains in capability. With the subsequent release of GPT-5, de Moor projects that integrating next-generation frontier models would yield offensive performance at least three times higher than the top-ranked human ethical hackers on HackerOne. Proving Real-World Exploitability as Exploitation Windows Collapse (5:19) De Moor contrasts autonomous black-box testing with white-box static code analyzers like 'MyChelle's.' While static analysis has direct source-code access, real-world adversaries rarely do. More critically, static analysis cannot verify whether code flaws are exploitable at runtime, quantify their true impact, or identify environment and configuration errors. Autonomous black-box verification solves this by validating practical exploitability. This distinction is critical due to the collapse of disclosure timelines. In 2018, the average lag between a public Common Vulnerabilities and Exposures (CVE) disclosure and active exploitation was two to two and a half years. Today, de Moor states that the window has 'gone negative,' with threat actors routinely exploiting vulnerabilities in the wild before public CVE notices appear. Consequently, he views market sell-offs in cybersecurity stocks over AI developments as fundamentally misguided. Defensive Realignment and the Accelerating Threat Window (7:27) To counter automated offensive capabilities, de Moor presents three recommendations. First, frontier model developers must maximize cyber capabilities rather than slowing deployment over safety debates, treating the environment as an active arms race. Second, human security researchers must be armed with autonomous tooling to scale their output. Third, enterprise defenders must narrow their attention to vulnerabilities with confirmed exploitability. De Moor warns that the timeline for defensive adjustment is narrow. Based on the current development velocity of software engineering agents, he forecasts that open-weight models will match proprietary frontier systems within 6 to 9 months, significantly lowering the barrier for autonomous cyber attacks worldwide. De Moor concludes that the window to prepare for autonomous AI adversaries is limited to months rather than years. However, his analysis relies heavily on proprietary benchmarks from his own commercial platform and assumes that open-weight models will maintain an uninterrupted trajectory toward high-end offensive parity without encountering defensive counterweights or architectural bottlenecks.

精炼阅读摘要

XBOW创始人Oege de Moor指出，网络安全正经历从人类辅助AI转向完全自主AI黑客的范式转变，拥有先进AI技术的一方将在对抗中占据决定性优势。他警告真实漏洞的利用窗口已缩短为负数，行业仅剩约6至9个月的时间窗口来构建AI防御体系以应对全自动威胁。黑盒测试突破与全球竞技验证 (1:34) 演讲者指出，全自主AI黑客Xbo已在高度设防的真实系统中验证了实战威胁。在针对微软Bing Image Search的审计中，Xbo在仅输入目标URL、未获得内部源码或人工协助的纯黑盒条件下，以3,000美元的公开目录成本自主发现了严重的远程代码执行（RCE）漏洞，该漏洞可导致目标系统被完全接管。这一案例表明，高度自动化的黑盒测试工具已能以极低成本穿透由顶级工程师维护的大型流量服务。为回应安全界对其自主攻防能力的普遍质疑，该公司将Xbo投入HackerOne漏洞赏金平台进行匿名实测。Xbo通过派遣侦察代理探测攻击面、筛选高价值端点并精准投放攻击向量，在数周内登顶全美黑客榜首，并于当年8月成为该平台全球排名第一的黑客。演讲者以此证明，自主AI代理在端到端漏洞挖掘与实战利用上的综合效能已超越顶尖人类白帽黑客。 “合金”多模型协作与能力跃升 (3:51) Xbo在竞技中的性能表现归功于一种被称为“合金”（alloy）的多模型协作机制。在取得HackerOne榜首时，该系统底层融合了Anthropic的Claude Sonnet与Google的Gemini。系统将整个渗透测试视作一系列有序的动作序列，在每一步决策时交替调用不同模型。这种机制如同两人结对编程，使模型能够在动态交互中相互发现错误并进行纠正，从而发挥出显著优于单一模型的整体攻防效能。演讲者进一步指出，在针对开源真实Web应用测试集的评估中，底层基础模型呈现出陡峭的能力上升曲线。随着GPT-5的推出，演讲者根据其能力表现估算，若将GPT-5集成进系统，其攻击效率将达到HackerOne最顶尖人类黑客的三倍以上。这一趋势意味着基础大模型推理能力的演进正在直接转化为自动化网络武器效能的倍增。可利用性验证与漏洞利用窗口归零 (5:19) 在攻防方法论上，演讲者对比了Xbo的黑盒验证与类似MyChelle's等基于源码的白盒分析工具。白盒测试虽然具备直接分析代码的条件，但现实中的恶意攻击者极少拥有源码权限；更重要的是，静态代码分析无法确认潜在缺陷在实际运行环境中是否真正可被利用，也无法识别因配置或部署错误导致的安全漏洞。Xbo通过直接在外部验证漏洞的“可利用性”，有效排除了无效警报，直接锚定致命威胁。与此同时，漏洞防护的时间窗口正在急剧崩塌。演讲者指出，2018年通用漏洞与披露（CVE）公告发布到被恶意攻击者实际利用的平均间隔约为2至2.5年，而如今该窗口已经“变为负数”——多数漏洞在官方公告披露之前，就已经在野外遭到黑客的大规模利用。鉴于攻击自动化带来的生存威胁，演讲者对传统网络安全股票因AI技术突破而遭遇抛售的现象表示无法理解，并认为防御方必须全面引入AI防御工具。长筱之战启示与6至9个月窗口 (7:27) 演讲者以1575年日本“长筱之战”作比：织田信长将作战视为可优化的系统并大规模部署火器，彻底击败了依赖精湛战技与传统骑兵的武田军团。网络安全领域正迎来同等维度的技术变革，墨守成规的人力防御必然失败。为此，演讲者提出三项紧急建议：前沿模型开发者应最大化模型的网络攻防能力而避免陷入安全争论导致的停滞；必须为人类安全研究人员配备自主AI工具以扩充防御产能；组织机构必须将资源优先集中于已被证明可被利用的漏洞。演讲者最后发出预警，防御方仅有约6到9个月的紧迫应对窗口。按照当前软件工程代理的发展速度，开源权重模型预计将在这一时间段内达到与先进商业闭源系统相当的能力水平。面对攻击工具平民化与普及化的前景，演讲者呼吁防御团队必须立即展开行动加固系统，否则防线将迅速失守。演讲者明确论证了自主AI黑客已经具备超越人类顶尖专家的端到端实战渗透能力，并重塑了以负时差利用为特征的安全态势。然而，关于前沿模型开发中放开安全限制与风险防控之间的平衡界限，以及防御方在仅剩的数月内如何有效完成全行业层面的技术部署，演讲者并未给出具体的制度规范或实施细节，这仍然是全行业需要面对的严峻议题。

Source quotes

[0:03] Oege de Moor: autonomous hacking where the AI does all the work without any human assistance. [0:03] Oege de Moor: Those with AI will win. [3:51] Oege de Moor: not some Mickey Mouse cyber benchmarks [5:19] Oege de Moor: gone negative [5:19] Oege de Moor: incomprehensible [7:27] Oege de Moor: preaching like Nostradamus [7:27] Oege de Moor: If you want to have a nice Thanksgiving dinner with your family, you better start fixing now.

Original transcript

[0:03] [applause] [0:04] >> Thank you very much. [0:09] You've all heard the story about the [0:11] breach of the Mexican government. [0:16] Human hackers used Open AI and Anthropic [0:19] as assistants in order to achieve a [0:22] massive data breach. [0:25] What I want to talk to you about today [0:27] is autonomous hacking where the AI does [0:31] all the work without any human [0:34] assistance. [0:37] The situation in cybersecurity today is [0:39] akin to the Battle of Nagashino in 1575 [0:43] in Japan. [0:45] In this picture on the left-hand side is [0:46] the army of Oda Nobunaga. [0:49] Nobunaga was an upstart. He was a minor [0:52] warlord, but he treated warfare as a [0:54] system to be optimized. [0:57] And in particular, he used the very [0:59] latest weapons, the very latest guns. [1:02] On the right-hand side is the Takeda [1:04] clan. [1:05] The Takeda clan was [1:08] extremely famous and their cavalry was [1:11] thought to be invincible. [1:14] They had many well-known warriors who [1:17] had earned their their their skills in [1:22] in battles before. [1:24] But guess who won. [1:27] The situation in cybersecurity is going [1:29] to be exactly the same. Those with AI [1:32] will win. [1:34] Just to set the scene, let me tell you [1:36] about one particular vulnerability. A [1:38] couple of weeks ago, Microsoft announced [1:40] a remote code execution vulnerability in [1:43] Bing image search. Bing image search, [1:46] one of the best secured systems in the [1:48] world, very well secured by the [1:51] engineers at Microsoft, but also [1:53] hammered by thousands of hackers from [1:55] all over the world trying to get in. [1:58] A remote code execution vulnerability, [2:01] the very worst kind of vulnerability [2:03] where you can run arbitrary code on the [2:06] target system, complete takeover. [2:10] This vulnerability was found by the [2:12] product of my company, Xbo. [2:14] And the only input it needed [2:17] was the URL. [2:19] Nothing else. [2:20] And the cost? [2:22] $3,000 [2:23] at list price. That's not what it cost [2:25] us. [2:27] So, it's fast, it's cheap, and extremely [2:31] effective. [2:32] The way Xbo works is very much like a [2:34] human hacker. It starts by [2:36] reconnaissance. It sends out a bunch of [2:38] scouts, agents that discover the attack [2:41] surface. [2:42] It prioritizes what endpoints look most [2:45] juicy, most promising for an attack, and [2:47] then it goes in and tries every relevant [2:50] attack type. [2:52] Despite evidence like this, [2:54] many human security researchers believe [2:56] that it's impossible to completely [3:00] autonomously carry out this task [3:04] with a machine. [3:05] So, in order to counter the skepticism, [3:07] already last year my company entered our [3:10] bot, Xbo, onto the HackerOne platform. [3:14] HackerOne is this platform that connects [3:16] companies that want their systems to be [3:17] tested with ethical hackers who will [3:20] then go and attack those systems and [3:22] report what vulnerabilities they find. [3:25] If they report good vulnerabilities, [3:27] they get paid a bounty and they get [3:28] points. [3:29] Within a few weeks, [3:31] Xbo first became the number one hacker [3:33] in the United States, and then in [3:34] August, it became the number one hacker [3:37] in the world. [3:38] And I have to stress this is completely [3:40] black box testing. It's just like the [3:42] Bing example I mentioned before. You [3:44] only give it the URL, nothing else. The [3:47] AI does the work completely [3:49] autonomously. [3:51] And that was back in August. [3:53] The the foundation models that we are [3:55] building on have enormously progressed [3:57] since then. This is on a set of open [4:00] source real web applications. These are [4:02] not some Mickey Mouse cyber benchmarks. [4:05] And uh [4:07] we started back in March last year. [4:10] We started 37 and then it reached the [4:13] top of the HackerOne leaderboard with an [4:15] alloy of Sonnet 40 and Gemini 25. I I [4:19] can't [4:20] I can't resist briefly telling you about [4:22] alloys. [4:24] So, think of these attacks as a sequence [4:26] of actions and at every step, you flip a [4:29] coin to decide what model to ask. Either [4:34] ask Gemini or ask Sonnet. This is much [4:36] better than either model separately. [4:38] It's a bit like like pair programming. [4:41] The two models [4:42] uh compensate for each other's mistakes. [4:45] So, then shortly after Xbo topped the [4:48] the HackerOne leaderboard, GPT-5 came [4:50] out. [4:51] Just extrapolating from its performance, [4:53] it would have done at least three times [4:55] better. So, in August, [4:57] Xbo was a little bit better than the [5:00] best the best human on HackerOne. [5:03] With GPT-5, it would have been three [5:05] times better. [5:08] And since then, the [5:11] the models have only gotten better and [5:13] as you can see, we better collect a new [5:15] set of benchmarks because it's pretty [5:17] much saturated. [5:19] So, how should you think about this in [5:21] in relation to MyChelle's? [5:23] MyChelle's has been [5:25] as has mostly been been reported as a [5:29] tool that reads the source code [5:31] extremely well and points out potential [5:33] flaws in the code. [5:36] This is white box testing. It's not all [5:38] like what I was talking about about [5:40] before, purely black box testing. You [5:43] actually have access to the source code, [5:44] which of course is an advantage you do. [5:46] But as an attacker, you don't [5:48] necessarily. [5:51] The question with these with this code [5:53] analysis stuff is are the weaknesses [5:55] actually exploitable in the wild? And if [5:58] they are exploitable, does it matter? [5:59] What's the impact? Where can I go if I [6:02] get into if I can execute remote I I can [6:05] do remote code execution on a Bing [6:07] server, [6:08] where else can I get to? I I can't tell [6:11] you. [6:12] And then [6:15] of course there's many other [6:16] vulnerabilities that are configuration [6:19] or deployment problems. You can't [6:20] actually use them from the source code [6:22] itself. So, these are the questions that [6:24] Xbo answers for you. [6:28] If you get to know about a exploits, [6:32] it's probably already too late. So, you [6:34] typically like before the Bing example, [6:36] people publish a CVE to let the world [6:40] know that there was a vulnerability. [6:43] Back in 2018, [6:45] it the delay between publication of a [6:48] CVE and bad actors exploiting it in the [6:52] wild was almost two two and a half [6:54] years. [6:56] Today, the number has gone negative. For [6:58] most CVEs, [7:00] it is already being exploited before the [7:03] the [7:04] CVE is even published. [7:08] So, in view of all this evidence, it's [7:10] incomprehensible to me that whenever [7:12] there's news about AI and security, [7:15] cyber traditional cybersecurity stocks [7:17] drop. This makes no sense at all. We [7:19] need every possible defense that we can [7:22] get against these autonomous AI-powered [7:25] attacks. [7:27] So, so far I've been [7:29] preaching like Nostradamus, telling you [7:31] about all the bad things that might [7:33] happen. So, [7:34] let's try and rally the spirit of [7:36] Nobunaga, that Japanese warrior I talked [7:38] about at the beginning, and see what can [7:40] be done. [7:42] So, first of all, [7:44] all of you, everyone who's working on [7:45] frontier models, you must maximize the [7:48] cyber capabilities. No more talk about [7:50] whether it's safe to do that or not. [7:52] We're in an arms race, so we have to [7:54] make sure that we have the very best [7:56] models to power this type of work. [7:59] Secondly, [8:01] we need to enable human security [8:03] researchers to use this as an extension [8:05] of their own work in order to [8:08] to maximize the chances that we find all [8:11] the vulnerabilities before the bad guys [8:13] do. [8:13] And finally, you need to prioritize what [8:16] matters. You need to know whether the [8:17] bugs are truly exploitable and what [8:19] their impact is going to be, and Xbo can [8:22] help with that. [8:25] We've got about 6 to 9 months [8:28] to do this. [8:30] Just extrapolating from the from the [8:33] from the progress we software [8:35] engineering agents, [8:37] in 6 to 9 months we have we will have [8:39] open weight models that are just as good [8:42] as MyChelle's and similar models. [8:45] And so, if you want to have [8:48] a nice Thanksgiving dinner with your [8:50] family, [8:51] you better start fixing now. [8:54] Thank you. [8:57] >> [applause]