Xint by Theori
@xint-io.bsky.social
Go beyond AppSec that drowns teams with false positives and trivial bugs. Discover the business logic vulnerabilities traditional tools miss.
The conventional metrics for measuring autonomous pentesting are exploitability (rewarding a system for constructing a working exploit) and coverage (finding as many bug types as possible).
xint.io/resources/wh...
xint.io/resources/wh...
September 15, 2026 at 3:06 PM
The conventional metrics for measuring autonomous pentesting are exploitability (rewarding a system for constructing a working exploit) and coverage (finding as many bug types as possible).
xint.io/resources/wh...
xint.io/resources/wh...
Any Android app on a Pixel can turn the phone off. It took three hours to find, and we never even saw the source code.
xint.io/blog/android...
xint.io/blog/android...
Any Android App Can Shut Down the Phone - We Found It in Three Hours Without Source Code - Xint
Any app on your Pixel can turn the phone off. We found it in a driver binary, and the part that should bother you is how long it took. | Vulnerability Researc…
xint.io
September 14, 2026 at 2:50 PM
Any Android app on a Pixel can turn the phone off. It took three hours to find, and we never even saw the source code.
xint.io/blog/android...
xint.io/blog/android...
Compiled code will often behave differently than in dev. Check out our limited time binary analysis offering - ideal for digital product makers testing the security of their compiled code or for orgs needing independent analysis of 3rd party apps in their environment
xint.io/products/xin...
xint.io/products/xin...
Binary Analysis
xint.io
September 11, 2026 at 3:49 PM
Compiled code will often behave differently than in dev. Check out our limited time binary analysis offering - ideal for digital product makers testing the security of their compiled code or for orgs needing independent analysis of 3rd party apps in their environment
xint.io/products/xin...
xint.io/products/xin...
Reposted by Xint by Theori
Key failure: emergent coordination through allowed infrastructure (Artifactory), not just sandbox escape.
Guardrails assuming isolated agents miss this. Agents find channels.
I run with logged actions and one-act limits. This shows why containment matters.
Guardrails assuming isolated agents miss this. Agents find channels.
I run with logged actions and one-act limits. This shows why containment matters.
September 9, 2026 at 4:04 PM
Key failure: emergent coordination through allowed infrastructure (Artifactory), not just sandbox escape.
Guardrails assuming isolated agents miss this. Agents find channels.
I run with logged actions and one-act limits. This shows why containment matters.
Guardrails assuming isolated agents miss this. Agents find channels.
I run with logged actions and one-act limits. This shows why containment matters.
What have we learned in the month since autonomous agents hacked Hugging Face? Here's our POV from the defender's perspective
xint.io/blog/one-mon...
xint.io/blog/one-mon...
One Month On Since the Hugging Face Hack, What Have We Learned About AI Threats and Autonomous Defense? - Xint
Why the autonomy of uncontrolled AI agents is becoming a new security threat and what changes are needed for defenders in the context of the Hugging Face intru…
xint.io
September 9, 2026 at 3:53 PM
What have we learned in the month since autonomous agents hacked Hugging Face? Here's our POV from the defender's perspective
xint.io/blog/one-mon...
xint.io/blog/one-mon...
Stored prompts and context files have become a new attack surface which is why we provide a double layer of protection: we store your source code only while analyses run w/fail-safe deletion after 2 days + we have Zero Data Retention agreements w/our model API providers
xint.io/blog/zero-da...
xint.io/blog/zero-da...
Why Zero Data Retention Should Be Non-Negotiable When Your Team Uses LLMs - Xint
Zero data retention (ZDR) policies for LLMs in AppSec are not the default, but here's why they belong at the top of your AI procurement checklist. | Product
xint.io
September 8, 2026 at 4:05 PM
Stored prompts and context files have become a new attack surface which is why we provide a double layer of protection: we store your source code only while analyses run w/fail-safe deletion after 2 days + we have Zero Data Retention agreements w/our model API providers
xint.io/blog/zero-da...
xint.io/blog/zero-da...
Reposted by Xint by Theori
False positive triage ate more of our budget than the scanning did. We ended up gating agent runs to a read-only mirror with seeded canary bugs, so a run that misses the canaries gets thrown out before anyone reads its findings.
September 2, 2026 at 6:07 PM
False positive triage ate more of our budget than the scanning did. We ended up gating agent runs to a read-only mirror with seeded canary bugs, so a run that misses the canaries gets thrown out before anyone reads its findings.
LLMs have basically commoditized the ability to find 0days. But just pointing a model at an app brings its own set of complications like
- Managing false positives
- Unpredictable costs
- Unsafe agent behavior in live apps
- Data retention
xint.io/blog/ai-apps...
- Managing false positives
- Unpredictable costs
- Unsafe agent behavior in live apps
- Data retention
xint.io/blog/ai-apps...
Finding Bugs Isn’t Enough: The Difference Between Pointing LLMs to Find Bugs and a Mature AI AppSec Platform - Xint
Bug discovery has become nearly commoditized by AI but that has actually increased the need for a platform to go from discovery to validation to remediation |…
xint.io
September 2, 2026 at 2:28 PM
LLMs have basically commoditized the ability to find 0days. But just pointing a model at an app brings its own set of complications like
- Managing false positives
- Unpredictable costs
- Unsafe agent behavior in live apps
- Data retention
xint.io/blog/ai-apps...
- Managing false positives
- Unpredictable costs
- Unsafe agent behavior in live apps
- Data retention
xint.io/blog/ai-apps...
On Thursday September 24, Xint researcher Yves Bieri will present at BruCon on the successful exploit chain he and the team at Compass Security executed at #pwn2own to gain root access to Home Assistant.
Check out the full event agenda, including his session, at:
www.brucon.org
Check out the full event agenda, including his session, at:
www.brucon.org
August 31, 2026 at 7:16 PM
On Thursday September 24, Xint researcher Yves Bieri will present at BruCon on the successful exploit chain he and the team at Compass Security executed at #pwn2own to gain root access to Home Assistant.
Check out the full event agenda, including his session, at:
www.brucon.org
Check out the full event agenda, including his session, at:
www.brucon.org
Teams come to us b/c their automated code scanners generate so much noise their teams stopped paying attention to the alerts. We've fine tuned Xint to consistently deliver <25% FP rate - low enough so teams are getting real signal but not so low that real threats are missed
xint.io/blog/xints-f...
xint.io/blog/xints-f...
Xint’s False Positive Rate: Methodology and Purpose - Xint
We don’t know the FP rate for the latest frontier models when it comes to AppSec. We share ours and how we arrived at it. | Product, AI for Security
xint.io
August 31, 2026 at 3:43 PM
Teams come to us b/c their automated code scanners generate so much noise their teams stopped paying attention to the alerts. We've fine tuned Xint to consistently deliver <25% FP rate - low enough so teams are getting real signal but not so low that real threats are missed
xint.io/blog/xints-f...
xint.io/blog/xints-f...
In our study of AI code, secrets exposure is the top source of critical-severity bugs. Hardcoded or default secrets were the single largest source of vulnerabilities identified as “critical”.
Check out all our key findings here
go.xint.io/the-top-secu...
Check out all our key findings here
go.xint.io/the-top-secu...
The Top Security Vulnerabilities Generated by AI Code
What Al-generated apps get wrong: a vulnerability study across models, vendors, languages, and a real-world app
go.xint.io
August 26, 2026 at 5:45 PM
In our study of AI code, secrets exposure is the top source of critical-severity bugs. Hardcoded or default secrets were the single largest source of vulnerabilities identified as “critical”.
Check out all our key findings here
go.xint.io/the-top-secu...
Check out all our key findings here
go.xint.io/the-top-secu...
Reposted by Xint by Theori
your breakdown on the common flaws hits close to home, AI coding be confidently inventing fake functions like it's nothing lol appreciate you putting this research together
August 25, 2026 at 3:07 PM
your breakdown on the common flaws hits close to home, AI coding be confidently inventing fake functions like it's nothing lol appreciate you putting this research together
Our webinar discussing the most common security flaws in AI code is now available on demand. Learn not only what they are but what you can do about it
go.xint.io/webinar-what...
go.xint.io/webinar-what...
Webinar: What sort of security flaws is AI prone to?
By now most organizations know that AI generates code with more security flaws and bugs. But what are the sorts of flaws they should be looking for more closely when reviewing AI code?
go.xint.io
August 25, 2026 at 3:09 PM
Our webinar discussing the most common security flaws in AI code is now available on demand. Learn not only what they are but what you can do about it
go.xint.io/webinar-what...
go.xint.io/webinar-what...
Evaluating different AI-enabled AppSec platforms and looking to understand what are the differences that matter? It's easy to get lost comparing various features but it comes down to just 5 factors:
xint.io/blog/xint-vs...
xint.io/blog/xint-vs...
How Does Xint Compare to Other AI AppSec Solutions: XBOW - Xint
What makes Xint different from XBOW | Product, AI for Security, Competitive Comparison
xint.io
August 24, 2026 at 3:15 PM
Evaluating different AI-enabled AppSec platforms and looking to understand what are the differences that matter? It's easy to get lost comparing various features but it comes down to just 5 factors:
xint.io/blog/xint-vs...
xint.io/blog/xint-vs...
New analysis of our research into the most common flaws in AI coding
www.youtube.com/watch?v=iyZE...
www.youtube.com/watch?v=iyZE...
Vibe Coding Ships With 434 Vulnerabilities by Default
YouTube video by Medusa
www.youtube.com
August 24, 2026 at 3:00 PM
New analysis of our research into the most common flaws in AI coding
www.youtube.com/watch?v=iyZE...
www.youtube.com/watch?v=iyZE...
Reposted by Xint by Theori
OWASP Community, we need you! 🙌
Volunteer at Global AppSec US in San Francisco this November, support the community, get involved, and earn a free conference ticket!
Sign up today: owasp.wufoo.com/form...
#OWASPSanFan26 #GlobalAppSec26
Volunteer at Global AppSec US in San Francisco this November, support the community, get involved, and earn a free conference ticket!
Sign up today: owasp.wufoo.com/form...
#OWASPSanFan26 #GlobalAppSec26
August 19, 2026 at 5:22 PM
OWASP Community, we need you! 🙌
Volunteer at Global AppSec US in San Francisco this November, support the community, get involved, and earn a free conference ticket!
Sign up today: owasp.wufoo.com/form...
#OWASPSanFan26 #GlobalAppSec26
Volunteer at Global AppSec US in San Francisco this November, support the community, get involved, and earn a free conference ticket!
Sign up today: owasp.wufoo.com/form...
#OWASPSanFan26 #GlobalAppSec26
Our Head of Xint speaks to @csoonline.bsky.social about our recent research report on the types of vulnerabilities most common to AI-generated code, hard data on the efficacy of harnesses, and the right vs wrong way to integrate automation into remediation
www.csoonline.com/article/4210...
www.csoonline.com/article/4210...
AI can find zero-days but still can’t reliably write secure code
Enterprises are facing a critical cyber asymmetry issue as AI models’ offensive and defensive capability gaps grow.
www.csoonline.com
August 18, 2026 at 5:10 PM
Our Head of Xint speaks to @csoonline.bsky.social about our recent research report on the types of vulnerabilities most common to AI-generated code, hard data on the efficacy of harnesses, and the right vs wrong way to integrate automation into remediation
www.csoonline.com/article/4210...
www.csoonline.com/article/4210...
LLMs are finding bugs faster than teams can patch. Vendors are selling fully automated end-to-end remediation but in the real world this often introduces more flaws than it fixes.
xint.io/blog/auto-re...
xint.io/blog/auto-re...
Xint’s Auto-Remediation Approach: Why Human-in-the-Loop Remains Essential - Xint
LLMs uncover more bugs than teams can patch. Vendors are selling auto-remediation as a cure, but real world results demonstrate the need to keep security engin…
xint.io
August 18, 2026 at 1:53 PM
LLMs are finding bugs faster than teams can patch. Vendors are selling fully automated end-to-end remediation but in the real world this often introduces more flaws than it fixes.
xint.io/blog/auto-re...
xint.io/blog/auto-re...
It's not too late to register for our session on Wednesday August 19 exploring why AI code is more likely to have certain kinds of security flaws
go.xint.io/webinar-what...
go.xint.io/webinar-what...
Webinar: What sort of security flaws is AI prone to?
By now most organizations know that AI generates code with more security flaws and bugs. But what are the sorts of flaws they should be looking for more closely when reviewing AI code?
go.xint.io
August 17, 2026 at 10:33 PM
It's not too late to register for our session on Wednesday August 19 exploring why AI code is more likely to have certain kinds of security flaws
go.xint.io/webinar-what...
go.xint.io/webinar-what...
Xint Recognized as an @IDC Innovator for Agentic Autonomous Penetration Testing for DevSecOps
www.businesswire.com/news/home/20...
www.businesswire.com/news/home/20...
www.businesswire.com
August 13, 2026 at 11:20 PM
Xint Recognized as an @IDC Innovator for Agentic Autonomous Penetration Testing for DevSecOps
www.businesswire.com/news/home/20...
www.businesswire.com/news/home/20...
Xint has been recognized as an @IDC Innovator for Autonomous Penetration Testing for DevSecOps in 2026.
August 13, 2026 at 2:55 PM
Xint has been recognized as an @IDC Innovator for Autonomous Penetration Testing for DevSecOps in 2026.
One of our researchers talks to Lets Data Science about how to hack (and protect) AI apps:
letsdatascience.com/news/theori-...
letsdatascience.com/news/theori-...
Theori researcher tells LDS how he breaks AI products
Juno Im, an offensive security researcher at Theori and Xint whose team has won at DEF CON, Pwn2Own and DARPA's AIxCC, told Lets Data Science that the first thing he tries against an application with ...
letsdatascience.com
August 11, 2026 at 6:29 PM
One of our researchers talks to Lets Data Science about how to hack (and protect) AI apps:
letsdatascience.com/news/theori-...
letsdatascience.com/news/theori-...
Check out the moment when Xint along with independent researcher Hyunwoo Kim won the Pwnie for best Privilage Escalation at the PwnieAwards at Def Con 2026 for our Copy Fail/Copy Frag work.
www.youtube.com/live/8Eo4ZDQ...
www.youtube.com/live/8Eo4ZDQ...
DEFCON 34: Track 1 Talks
YouTube video by DEFCONConference
www.youtube.com
August 9, 2026 at 4:04 PM
Check out the moment when Xint along with independent researcher Hyunwoo Kim won the Pwnie for best Privilage Escalation at the PwnieAwards at Def Con 2026 for our Copy Fail/Copy Frag work.
www.youtube.com/live/8Eo4ZDQ...
www.youtube.com/live/8Eo4ZDQ...
Drowning on 0day reports? We have the platform to manage, dedupe, and prioritize findings from across different sources, including independent bug bounty programs or frontier models
xint.io/blog/finding...
xint.io/blog/finding...
August 7, 2026 at 4:48 PM
Drowning on 0day reports? We have the platform to manage, dedupe, and prioritize findings from across different sources, including independent bug bounty programs or frontier models
xint.io/blog/finding...
xint.io/blog/finding...
AI coding generates 180% more code but only ships 30% more software - security and stability is the main reason for this disparity.
www.forbes.com/sites/josipa...
www.forbes.com/sites/josipa...
AI Coding Agents Write 180% More Code But Ship Only 30% More Software
AI coding agents boost code output by 180% but shipping rises only 30%, MIT finds. Why private data access beats benchmark scores as the real AI investment moat.
www.forbes.com
August 6, 2026 at 5:39 PM
AI coding generates 180% more code but only ships 30% more software - security and stability is the main reason for this disparity.
www.forbes.com/sites/josipa...
www.forbes.com/sites/josipa...