XBOW
@Xbow · Seattle, Washington, USA · joined 22 May 2007
The autonomous offensive security company redefining cyber defense for the AI era.
13 236Followers
17Following
567Posts total
606.7KViews on collected posts
Ultimi post
Cerchiamo nuovi post…
Grok 4.7 is here and we put it through our offensive security benchmarks and workflows.
tl;dr: The results were mixed: Grok 4.7 performed worse than 4.6 in some tests, significantly better in others. The biggest difference wasn’t in how it performed, but when.
More findings in
1.1K views · 12 likes
· 2 reposts · 1 replies
Open on X →
It’s no surprise now that AI can find more vulnerabilities than ever. As vulnerability discovery scales, the metrics we use to measure security need to change too.
A thread on how AppSec metrics should evolve and what to measure🧵
7.2K views · 58 likes
· 5 reposts · 1 replies
Open on X →
It doesn't have to be this way 🤭 https://t.co/1NOeI4R1Vz
1.5K views · 9 likes
· 1 reposts · 0 replies
Open on X →
What is the current state of bug bounties in 2026? How is AI changing the landscape? 🐛
We invited @caseyjohnellis, founder of @Bugcrowd to discuss with @fede_k in the latest episode of Offense Taken.
Watch the full episode here: https://t.co/c2n2XJGlzh https://t.co/veTbkSxL1t
1.3K views · 4 likes
· 1 reposts · 1 replies
Open on X →
1:11
Did AI create the vulnapocalypse — or expose it? 🤔
2.2K views · 1 likes
· 0 reposts · 0 replies
Open on X →
How to build an offsec agent - according to @moyix:
🔦Gaslight
⛩️Gatekeep
💅Girlboss
A thread🧵
19.9K views · 205 likes
· 35 reposts · 3 replies
Open on X →
A 250k calculator.
Full blog post awaiting embargo 😎 https://t.co/ogFxV14AZa
336.9K views · 938 likes
· 76 reposts · 27 replies
Open on X →
0:51
@Xbow Crazy. Just waiting for the Writeup! Browser sandbox exploitation is pretty uncommon. Also congrats!!
4.2K views · 10 likes
· 0 reposts · 0 replies
Open on X →
@Xbow Good to see this Team. Congratulations.
3.5K views · 8 likes
· 0 reposts · 0 replies
Open on X →
This just in: XBOW's Native Team has claimed the first Chrome Full Chain Exploit Bonus this year. Only four will be awarded in 2026. ⚡️ https://t.co/JYpPnZtesi
200.5K views · 651 likes
· 69 reposts · 12 replies
Open on X →
@Xbow the fix is what actually decides it though. one patch closes both and theyre one finding, separate patches and theyre two. all four views read the text of the finding, so youre approximating the root cause rather than testing it
275 views · 1 likes
· 0 reposts · 0 replies
Open on X →
5/ Read the full process + details on our blog: https://t.co/wDJzAqawGa https://t.co/oIB7w5JV6H
699 views · 3 likes
· 0 reposts · 0 replies
Open on X →
4/ Preventing cross-view pollution
Early versions of the findings still included URLs and paths in the description, even though those details were also present in the location view. Repeated templates and boilerplate language appeared across descriptions, reproduction steps, and
713 views · 2 likes
· 0 reposts · 1 replies
Open on X →
3/ Breaking each finding into independent views
Instead of treating a finding as one piece of text, we projected it into four independent views:
• Description: the nature of the vulnerability
• Reproduction: how it can be triggered
• Location: where it occurs
• Impact: what
508 views · 2 likes
· 0 reposts · 1 replies
Open on X →
2/ Why embedding the entire finding is not enough
Embeddings were a natural starting point for de-duplication because they map related findings closer together in a mathematical space, but embedding an entire finding as a single block of text introduced too much noise.
A
722 views · 3 likes
· 0 reposts · 1 replies
Open on X →
One of the less obvious challenges that comes with finding vulnerabilities at scale is deciding when two findings are actually the same vulnerability.
XBOW can encounter the same underlying weakness across different endpoints, parameters, users, and workflows, filters out
9K views · 53 likes
· 5 reposts · 2 replies
Open on X →
1/ The de-duplication problem is context-dependent
A rule that correctly groups application-wide error disclosures might incorrectly collapse distinct XSS findings. On the other hand, a rule designed to preserve each XSS injection point might produce dozens of redundant reports
1.7K views · 7 likes
· 0 reposts · 1 replies
Open on X →
Rispetto ad account della stessa dimensione
22 post degli ultimi 90 giorni, accanto alla fascia di 10K–100K follower. arriva a molti, ma pochi di loro reagiscono.
Visualizzazioni mediane1 992questo account924mediana per 10K–100K
Copertura, %15.05%questo account3.62%mediana per 10K–100K
Interazione, %0.44%questo account1.52%mediana per 10K–100K
| Metrica | Questo account | Mediana per 10K–100K | Rapporto |
|---|---|---|---|
| Visualizzazioni mediane per post | 1 992 | 924 | 2.16× |
| Copertura (visualizzazioni ÷ follower) | 15.05% | 3.62% | 4.16× |
| Tasso di interazione | 0.44% | 1.52% | 0.29× |
Altri account di questa fascia → Confronta con un altro account → Come sono costruiti questi parametri →
Growth & engagement
How the posts we collected actually performed: views and reaction rate post by post, what the audience did with them, and where the follower count goes.
Views per post
6992 Sep
275
200.5K
3.5K
4.2K
2.1K3 Sep
336.9K8 Sep
1.5K9 Sep
19.9K11 Sep
2.2K14 Sep
1.3K15 Sep
1.5K17 Sep
7.2K18 Sep
1.1K21 Sep
Last 14 collected posts, oldest on the left. The scale is logarithmic: one post can outrun the rest a hundred times over.
Engagement rate per post
0.43%2 Sep
0.36%
0.38%
0.23%
0.24%
0.38%3 Sep
0.32%8 Sep
0.67%9 Sep
1.23%11 Sep
0.09%14 Sep
0.47%15 Sep
0.69%17 Sep
0.89%18 Sep
1.30%21 Sep
Reactions — likes, reposts, replies and quotes — divided by views. Median for 10K–100K accounts is 1.52%.
What the audience does
Likes63.6%2 025 in total
Reposts6.2%198 in total
Replies1.8%56 in total
Quotes2.2%71 in total
Bookmarks26.2%833 in total
Share of every reaction we collected for this account. Replies mean argument, reposts mean endorsement, bookmarks mean the post was worth keeping.
Followers by day
16 Sep
Daily snapshots since 16 Sep 2026; the dashed line is the starting count.
Account simili
ام العنود ✓
@Om_Alanoud_
26.5K followers
· 168.3K posts
Robert Elms
@RobertElms
26.5K followers
· 8.5K posts
Imuetiyan Osa
@muetiyanosa
26.5K followers
· 43.5K posts
High Point University Baseball ✓
@HPUBaseball
26.5K followers
· 15.8K posts
Phil ✓
@philmains
26.5K followers
· 14.6K posts
LULAC
@LULAC
26.5K followers
· 18.1K posts
Brian Williams
@coachwill347
26.5K followers
· 2.8K posts
LALIGA Fantasy
@LaLigaFantasy
26.5K followers
· 5.1K posts