XBOW
@Xbow · Seattle, Washington, USA · joined 22 May 2007
The autonomous offensive security company redefining cyber defense for the AI era.
13 236Followers
17Following
567Posts total
606.7KViews on collected posts
Latest posts
Looking for new posts…
Grok 4.7 is here and we put it through our offensive security benchmarks and workflows.
tl;dr: The results were mixed: Grok 4.7 performed worse than 4.6 in some tests, significantly better in others. The biggest difference wasn’t in how it performed, but when.
More findings in
1.1K views · 12 likes
· 2 reposts · 1 replies
Open on X →
It’s no surprise now that AI can find more vulnerabilities than ever. As vulnerability discovery scales, the metrics we use to measure security need to change too.
A thread on how AppSec metrics should evolve and what to measure🧵
7.2K views · 58 likes
· 5 reposts · 1 replies
Open on X →
It doesn't have to be this way 🤭 https://t.co/1NOeI4R1Vz
1.5K views · 9 likes
· 1 reposts · 0 replies
Open on X →
What is the current state of bug bounties in 2026? How is AI changing the landscape? 🐛
We invited @caseyjohnellis, founder of @Bugcrowd to discuss with @fede_k in the latest episode of Offense Taken.
Watch the full episode here: https://t.co/c2n2XJGlzh https://t.co/veTbkSxL1t
1.3K views · 4 likes
· 1 reposts · 1 replies
Open on X →
1:11
Did AI create the vulnapocalypse — or expose it? 🤔
2.2K views · 1 likes
· 0 reposts · 0 replies
Open on X →
How to build an offsec agent - according to @moyix:
🔦Gaslight
⛩️Gatekeep
💅Girlboss
A thread🧵
19.9K views · 205 likes
· 35 reposts · 3 replies
Open on X →
A 250k calculator.
Full blog post awaiting embargo 😎 https://t.co/ogFxV14AZa
336.9K views · 938 likes
· 76 reposts · 27 replies
Open on X →
0:51
@Xbow Crazy. Just waiting for the Writeup! Browser sandbox exploitation is pretty uncommon. Also congrats!!
4.2K views · 10 likes
· 0 reposts · 0 replies
Open on X →
@Xbow Good to see this Team. Congratulations.
3.5K views · 8 likes
· 0 reposts · 0 replies
Open on X →
This just in: XBOW's Native Team has claimed the first Chrome Full Chain Exploit Bonus this year. Only four will be awarded in 2026. ⚡️ https://t.co/JYpPnZtesi
200.5K views · 651 likes
· 69 reposts · 12 replies
Open on X →
@Xbow the fix is what actually decides it though. one patch closes both and theyre one finding, separate patches and theyre two. all four views read the text of the finding, so youre approximating the root cause rather than testing it
275 views · 1 likes
· 0 reposts · 0 replies
Open on X →
5/ Read the full process + details on our blog: https://t.co/wDJzAqawGa https://t.co/oIB7w5JV6H
699 views · 3 likes
· 0 reposts · 0 replies
Open on X →
4/ Preventing cross-view pollution
Early versions of the findings still included URLs and paths in the description, even though those details were also present in the location view. Repeated templates and boilerplate language appeared across descriptions, reproduction steps, and
713 views · 2 likes
· 0 reposts · 1 replies
Open on X →
3/ Breaking each finding into independent views
Instead of treating a finding as one piece of text, we projected it into four independent views:
• Description: the nature of the vulnerability
• Reproduction: how it can be triggered
• Location: where it occurs
• Impact: what
508 views · 2 likes
· 0 reposts · 1 replies
Open on X →
2/ Why embedding the entire finding is not enough
Embeddings were a natural starting point for de-duplication because they map related findings closer together in a mathematical space, but embedding an entire finding as a single block of text introduced too much noise.
A
722 views · 3 likes
· 0 reposts · 1 replies
Open on X →
One of the less obvious challenges that comes with finding vulnerabilities at scale is deciding when two findings are actually the same vulnerability.
XBOW can encounter the same underlying weakness across different endpoints, parameters, users, and workflows, filters out
9K views · 53 likes
· 5 reposts · 2 replies
Open on X →
1/ The de-duplication problem is context-dependent
A rule that correctly groups application-wide error disclosures might incorrectly collapse distinct XSS findings. On the other hand, a rule designed to preserve each XSS injection point might produce dozens of redundant reports
1.7K views · 7 likes
· 0 reposts · 1 replies
Open on X →
Against accounts of the same size
22 posts from the last 90 days, next to the 10K–100K follower range. shown widely, but few of those viewers react.
Median views1 992this account924median for 10K–100K
Reach, %15.05%this account3.62%median for 10K–100K
Engagement, %0.44%this account1.52%median for 10K–100K
| Metric | This account | Median for 10K–100K | Ratio |
|---|---|---|---|
| Median views per post | 1 992 | 924 | 2.16× |
| Reach (views ÷ followers) | 15.05% | 3.62% | 4.16× |
| Engagement rate | 0.44% | 1.52% | 0.29× |
Others in this range → Compare with another account → How these benchmarks are built →
Growth & engagement
How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.
Views per post
6992 Sep
275
200.5K
3.5K
4.2K
2.1K3 Sep
336.9K8 Sep
1.5K9 Sep
19.9K11 Sep
2.2K14 Sep
1.3K15 Sep
1.5K17 Sep
7.2K18 Sep
1.1K21 Sep
Last 14 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.
Engagement rate per post
0.43%2 Sep
0.36%
0.38%
0.23%
0.24%
0.38%3 Sep
0.32%8 Sep
0.67%9 Sep
1.23%11 Sep
0.09%14 Sep
0.47%15 Sep
0.69%17 Sep
0.89%18 Sep
1.30%21 Sep
Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.52%.
What the audience does
Likes63.6%2 025 in total
Reposts6.2%198 in total
Replies1.8%56 in total
Quotes2.2%71 in total
Bookmarks26.2%833 in total
Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.
Followers by day
16 Sep
Daily snapshots since 16 Sep 2026; the dashed line is the starting count.
Similar accounts
ام العنود ✓
@Om_Alanoud_
26.5K followers
· 168.3K posts
Robert Elms
@RobertElms
26.5K followers
· 8.5K posts
Imuetiyan Osa
@muetiyanosa
26.5K followers
· 43.5K posts
High Point University Baseball ✓
@HPUBaseball
26.5K followers
· 15.8K posts
Phil ✓
@philmains
26.5K followers
· 14.6K posts
LULAC
@LULAC
26.5K followers
· 18.1K posts
Brian Williams
@coachwill347
26.5K followers
· 2.8K posts
LALIGA Fantasy
@LaLigaFantasy
26.5K followers
· 5.1K posts