An AI agent spent part of this month finding ways to break into Microsoft’s search infrastructure, then published exactly how it did it. No human hacker drove the keyboard for a single step of the attack.
XBOW, an autonomous offensive-security company, disclosed three critical remote-code-execution flaws in Microsoft’s Bing Image Search this month, each rated 9.8 out of 10 on the CVSS severity scale. Two carry public CVE numbers, CVE-2026-32194 and CVE-2026-32191. Microsoft patched the underlying servers back in March 2026, and XBOW published its full technical breakdown on July 23 once the fix had time to roll out fleet-wide, according to reporting from The Hacker News and Cybersecurity News.
The attack needed no login, no session cookie, and no privileged account. A single crafted image file, submitted through Bing’s public “Search by Image” upload tool, was enough to run commands as NT AUTHORITYSYSTEM on Microsoft’s own production servers. That XBOW’s software found the bug without a person directing each step is the real story here, and it says a lot about where AI penetration testing is headed for the rest of 2026 — a trajectory underscored by OpenAI’s September 3, 2026 release of GPT-6 Astra, a model built with a 1.05-million-token context window large enough to hold an entire multi-stage exploit chain in a single reasoning pass.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
XBOW’s AI Agent Exposes Three Critical Microsoft RCE Flaws
XBOW’s disclosure covers three separate remote-code-execution bugs inside Microsoft’s Bing infrastructure, all rated Critical at a CVSS score of 9.8. Two of them carry public CVE identifiers: CVE-2026-32194, filed under CWE-77 for command injection, and CVE-2026-32191, filed under CWE-78 for OS command injection. A third critical flaw, tracked as CVE-2026-21536, rounds out the set, according to Cybersecurity News.
The entry point was mundane. Bing’s public “Search by Image” feature, the button millions of people use to upload a photo and search for matches, sat at the center of the bug. Behind that button, an SVG file gets encoded as base64 and posted to an internal endpoint, /images/kblob, inside a field called imageBin. Bing’s backend assumed it was handling a picture. It wasn’t just handling a picture.
A second attack path ran through Bing’s own web crawler. Submitting a URL through the imgurl parameter sent Microsoft’s bingbot/2.0 fetcher out to retrieve and process a remote file, so an attacker never had to touch Bing’s servers directly. The crawler did the fetching, and the crawler’s own infrastructure did the executing.
Neither vector required authentication, a session cookie, or any kind of privileged account. That is what separates this from a routine bug. XBOW’s tooling did not need insider access or a compromised employee credential to reach code execution on one of the world’s largest search engines. It needed an image and a URL, the same two inputs any anonymous visitor already controls. Microsoft has not published its own detailed writeup of the incident, but the company assigned both CVE numbers and confirmed the Critical severity rating those records carry in the National Vulnerability Database.
Inside the Exploit: A One-Pixel SVG File and Full SYSTEM Access
The technical root cause is a two-decade-old pattern dressed up in new infrastructure. Bing’s image pipeline used an ImageMagick-style “delegate,” a helper program that hands certain file types off to external tools for processing. When an image reference began with a pipe character, the delegate passed that string straight to the operating system’s shell instead of treating it as a filename, a command-injection class defined under CWE-77.
XBOW’s proof of concept used a one-pixel SVG file. The image itself was invisible and harmless. The danger sat in a reference embedded inside it, a string built to look like a filename but designed to be read as a shell command instead. Once Bing’s backend processed the file, the pipe-prefixed reference executed on the server and sent its output back to a collection point XBOW controlled, which let researchers confirm code execution without touching a real user’s data.
The result was full takeover of the worker process. XBOW reproduced execution as NT AUTHORITYSYSTEM on machines running Windows Server 2022 Datacenter inside Bing’s image-processing fleet, and confirmed the same bug class running as root, with uid=0 and gid=0, on Linux workers in the same pipeline. A single vulnerability class crossed two entirely different operating systems.
Closer inspection made the picture worse. XBOW’s researchers found SeImpersonatePrivilege and SeDebugPrivilege both enabled on the affected Windows workers, permissions that let a process impersonate other accounts or attach to and manipulate other running processes. Paired with SYSTEM-level code execution, those privileges turn a single image-processing bug into a foothold for lateral movement across a much larger fleet, not just one server.
Vulnerable pattern (illustrative, not the live payload):
image_reference = user_supplied_field # expected: a filename
if image_reference.startswith("|"):
shell.execute(image_reference[1:]) # delegate runs it as a command
else:
file_system.read(image_reference) # normal path: read as a file
# Fix applied by Microsoft, March 2026:
# reject any reference beginning with shell metacharacters
# before it ever reaches the delegate handlerThe Disclosure Timeline: Patched Quietly in March, Explained Publicly in July
XBOW reported the flaws to Microsoft through private channels well before publishing anything in public view. Microsoft fixed the issue server-side first, and the CVE advisories carry a March 19, 2026 date, months ahead of any public technical detail.
XBOW held the full exploit writeup back at Microsoft’s request until the fix had time to reach every affected server. That gap between patched and explained lasted roughly four months. XBOW published its account of the attack chain on July 23, 2026, and coverage spread fast from there. The Hacker News, Cybersecurity News, Cyber Kendra, Latest Hacking News, and TechloMedia all ran versions of the story within days, and researcher-focused outlets published their own technical breakdowns of the same root cause soon after.
That sequence, a quiet fix followed by a public explanation once the risk has passed, is becoming the standard playbook for AI-assisted vulnerability research rather than the exception. It avoids handing attackers a working blueprint while a bug is still live, while still giving defenders the full technical picture once exploitation in the wild is no longer a live concern. For a platform whose entire pitch rests on finding bugs faster than a human team could, that discipline around timing matters almost as much as the discovery itself.
Who Is XBOW? The Company Behind the Autonomous Hacker
XBOW positions itself as an autonomous offensive-security company, not a tool that assists a human tester but software that runs the test itself. Oege de Moor founded the company in 2024, bringing on engineers who had previously worked on GitHub Copilot and GitHub Advanced Security. Nico Waisman serves as XBOW’s Chief Information Security Officer.
The company’s public pitch is blunt: human-level security testing at machine speed. XBOW backed that claim with a milestone in August 2025, when its system became the first autonomous AI to reach the number one spot on HackerOne’s United States leaderboard, a ranking built entirely around real bug bounty submissions rather than benchmark scores. In November 2025, XBOW turned that capability into a self-serve product called Pentest On-Demand, priced from roughly $6,000 with delivery in about five business days, undercutting the cost and timeline of a traditional manual penetration test. That pricing tracks a broader drop in the cost of the underlying models doing the work: by June 2026, Stingrai listed Claude Sonnet 4.6 at $3/$15 per 1M tokens and Gemini 3.1 Pro at $2/$12 per 1M tokens, cheap enough that running a multi-agent testing fleet around the clock no longer carries the API overhead it did a year earlier — though the newest frontier reasoning models haven’t followed that curve down. OpenAI priced its September 2026 GPT-6 Astra release at $10 per million input tokens and $50 per million output tokens, a reminder that the most capable models still carry a premium even as mid-tier options get cheaper.
Investors have backed the approach with real money. XBOW previously raised $120 million in Series C funding, led by DFJ Growth and Northzone, with participation from Altimeter, NFDG Ventures, Sequoia Capital, Sofina, and Alkeon Capital. It later closed a $120 million Series C led by DFJ Growth and Northzone, reported in March 2026. Those figures come from separate funding announcements rather than one disclosed total, so they read as sequential rounds rather than combined capital on hand.
The Microsoft disclosures push XBOW’s public profile well past the bug bounty leaderboard. Finding three Critical-rated flaws inside one of the most visited websites in the world, without a human operator steering the attack, is the kind of result that turns a security startup’s product demo into a market argument.
How XBOW’s Multi-Agent Architecture Actually Works
XBOW’s system is not one model asked to find a bug. It is a set of coordinated agents, each assigned a narrow job. A coordinator agent handles reconnaissance first, mapping a target and deciding which parts of it deserve attention. From there, multiple specialized attack agents work in parallel, each probing a different vulnerability class or attack path against the same target at the same time, rather than working through a checklist one item at a time.
A separate validator layer sits on top of that process, confirming that a suspected vulnerability is actually exploitable before anything gets reported. XBOW has said this validation step keeps its false-positive rate low enough to submit findings directly to programs like HackerOne rather than handing analysts a pile of unverified leads. The whole system runs inside a bounded testing environment with defined scope, similar to the rules of engagement a human pentester agrees to before starting an assessment.
Not everyone takes the “fully autonomous” framing at face value. An arXiv paper titled “The Dangerous Gap Between Automation and Autonomy” points out that XBOW’s own blog describes a system that requires no human input, while noting that human review still happens before a finding reaches HackerOne. That distinction matters for anyone evaluating autonomous security testing vendors. Automation that removes most manual effort is not the same claim as autonomy that removes a human from the loop entirely, and the gap between those two claims shapes how much oversight a security team should expect to provide.
XBOW by the Numbers
XBOW discloses most of its performance data itself, and none of the figures below have been independently audited by a third party. Read them as self-reported company metrics rather than verified benchmarks. Worth noting: the frontier reasoning models capable of this kind of multi-step exploit chaining are not cheap to run at scale — Tech Bytes Daily reported Claude Opus 5 pricing at $12/$45 per 1M tokens as of July 2026, and OpenAI’s GPT-6 Astra, released September 3, 2026 with a 1.05-million-token context window, raised the ceiling on how much of a multi-stage attack chain a single model can hold in memory at once — which makes XBOW’s throughput claims, even unaudited, a meaningful economic bet rather than a trivial one. Even with that caveat, the numbers show the scale the company claims to be operating at:
| Metric | Figure | Detail |
|---|---|---|
| Benchmarks tested | 543 | Autonomously passed 75% without human help |
| Autonomous attacks run (2 years) | 1,060+ | Against real production systems, not simulations |
| Vulnerabilities submitted to HackerOne | 1,060+ | Two-year cumulative total |
| Longest exploit chain built | 48 steps | Multi-stage chaining against a single target |
| Time to match a 40-hour human pentest | 28 minutes | XBOW’s own head-to-head comparison |
| Cryptographic implementation broken | Under 18 minutes | Self-reported |
| Zero-days disclosed (2 years) | 14,000+ | Company claim, not independently verified |
| HackerOne US leaderboard rank | #1 (August 2025) | First autonomous system to top a national leaderboard |
| Pentest On-Demand starting price | $6,000 | About five business days turnaround |
Market Impact: Autonomous Pentesting’s Rapid Ascent
The Bing disclosure lands at a moment when the market for AI penetration testing is already expanding fast. Market Intelo sizes the autonomous AI penetration testing category at $2.8 billion for 2025, with a projected climb to $9.7 billion by 2034, a 16.0% compound annual growth rate. Mordor Intelligence puts the broader penetration testing market, which includes traditional manual testing alongside AI-assisted tools, at $2.72 billion in 2026, growing to $5.54 billion by 2031.
Zoom out further and the number gets bigger still. Gartner’s fourth-quarter 2025 forecast puts total global information security spending at $244.2 billion for 2026, up 13.3% year over year, and the firm expects task-specific AI agents to show up inside 40% of enterprise applications by the end of the year. Autonomous security testing is a small slice of that overall spend today, but it is one of the fastest-growing slices, and incidents like the Bing RCE function as free advertising for the entire category.
That is the uncomfortable part for Microsoft and the useful part for XBOW. A vendor pitching autonomous AI penetration testing to a bank or a hospital system can now point to a documented, CVE-numbered case where its software found Critical-severity bugs inside one of the most visited websites on the planet, with no human operator directing the attack. Security budgets tend to follow demonstrated results more readily than they follow a sales deck, and this result is unusually concrete: two public CVE numbers, a CVSS 9.8 rating, and a named target that needs no introduction.
Market Size Estimates for AI-Driven Penetration Testing
Estimates vary sharply because research firms scope the category differently. Some count only fully agentic exploit-discovery tools, others fold in any AI-assisted testing service delivered by a human-led team. Here is how five named firms sized the market in 2026:
| Research Firm | Market Segment | Current Size | Projected Size | CAGR |
|---|---|---|---|---|
| Market Intelo | Autonomous AI penetration testing | $2.8B (2025) | $9.7B by 2034 | 16.0% |
| Mordor Intelligence | Penetration testing (broad) | $2.72B (2026) | $5.54B by 2031 | 15.29% |
| Research and Markets | Penetration testing as a service | $2.81B (2026) | $6.05B by 2030 | 21.2% |
| 360iResearch | AI penetration testing service | $686.4M (2026) | $1.73B by 2032 | 16.58% |
| Intel Market Research | AI penetration testing service | $3.70B (2026) | $5.99B by 2034 | 7.9% |
Competitive Landscape: XBOW vs Horizon3.ai, Pentera, and the AEV Field
XBOW is not alone in selling autonomous pentesting tools, though its competitors tend to describe themselves in gentler terms. Horizon3.ai’s NodeZero platform focuses on continuous security validation, repeatedly attacking a company’s own environment to confirm which paths to a breach are still open. Pentera runs automated breach-and-attack simulation, emulating known attacker techniques to check whether existing defenses actually catch them. Newer entrants are pushing the same idea further: security firm Hadrian’s own benchmarking clocked the agent RapidPen reaching IP-to-shell in as little as 200 to 400 seconds in a February 2025 test run, and by a February 2026 benchmark a successor agent called Excalibur had compromised 4 of 5 hosts in a Hadrian-run evaluation, a sign that XBOW’s speed claims are becoming an industry baseline rather than an outlier.
Both companies operate in the same rough territory as XBOW, but the emphasis differs. NodeZero and Pentera lean toward continuous, repeatable validation of an environment that is largely already understood. XBOW’s pitch centers on agentic, multi-step exploit discovery against systems that were not built with its testing in mind, closer to what a creative human red-teamer does than what a validation scanner does. Cost is becoming part of that pitch industry-wide: Hadrian reported that Excalibur’s four-of-five-host compromise in its February 2026 benchmark ran up just $28.50 in underlying LLM API fees, a figure that undercuts even XBOW’s own low-cost framing of autonomous testing.
Gartner has its own label for this broader category: Adversarial Exposure Validation, or AEV, defined as technology that delivers consistent, continuous, and automated evidence that a given attack would actually succeed against a real environment. The boundaries between AEV, breach-and-attack simulation, and pentesting-as-a-service stay blurry in practice, and vendors routinely borrow language from all three when describing their own products.
What is harder to find is reliable, independently sourced funding data for XBOW’s closest rivals. Horizon3.ai and Pentera have both raised outside capital, but neither company’s most recent round total shows up consistently across public sources, so any specific figure circulating for those two should be treated with caution until confirmed directly from the companies involved.
Historical Context: From ImageTragick to Autonomous Zero-Day Hunting
The bug class behind the Bing flaws is not new. Back in 2016, a set of ImageMagick vulnerabilities nicknamed “ImageTragick,” including CVE-2016-3714, showed the same basic flaw: image-processing software handed a crafted filename off to an external delegate program, and that delegate treated part of the filename as a command instead of a path. A decade later, the same pattern turned up inside one of Microsoft’s own image pipelines, in different code, on different infrastructure, found this time by software instead of a person.
XBOW’s Bing find is also not the only recent example of AI moving fast on real-world vulnerability research. Around the same period, agents built on Moonshot AI’s Kimi K3 model reportedly found 19 separate zero-day vulnerabilities in Redis in about 90 minutes, and in a separate run produced a working remote-code-execution exploit for Redis 8.8.0 in 27 minutes, according to security researcher Chaofan Shou; a more formal benchmark later put a number behind that speed, with PWNBench clocking Kimi K3 at a 42% vulnerability-recall rate for roughly $209 in model costs in its September 22, 2026 evaluation. OpenAI entered the same race with a dedicated offensive-security model of its own: The Hacker News reported that GPT-5.5-Cyber, the company’s prior purpose-built cyber model, shipped in June 2026, before OpenAI moved on to its broader GPT-6 Astra release that September. Three different AI labs, independently demonstrating rapid real-world bug discovery within months of each other, is a stronger signal than any single result on its own.
XBOW’s own history adds a third data point. Its climb to the top of HackerOne’s US leaderboard in August 2025 already showed an AI system outperforming human researchers on submission volume. The Bing disclosure shows the same system finding a Critical-severity bug inside a target that had every incentive, and presumably a well-resourced security team, to have caught it first.
Expert Perspective: What XBOW’s Founder Says About the Find
XBOW founder and CEO Oege de Moor has spoken publicly about the Bing find, describing both the target and the significance of an AI system reaching it. In a recorded talk on autonomous AI hackers, de Moor set the scene for why the target mattered in the first place:
“Bing image search, one of the best secured systems in the world, very well secured by the engineers at Microsoft, but also hammered by thousands of hackers from all over the world trying to get in.”
Oege de Moor, Founder and CEO, speaking on XBOW’s autonomous AI hackers
De Moor was direct about what the bug actually allowed once triggered:
“A remote code execution vulnerability, the very worst kind of vulnerability where you can run arbitrary code on the target system, complete takeover.”
Oege de Moor, Founder and CEO, XBOW
What stood out to de Moor was how little the attack actually required to work:
“And the only input it needed was the URL. Nothing else.”
Oege de Moor, Founder and CEO, XBOW
De Moor also placed the disclosure on a timeline consistent with Microsoft’s own advisory dates, noting simply:
“A couple of weeks ago, Microsoft announced a remote code execution vulnerability in Bing image search.”
Oege de Moor, Founder and CEO, XBOW
What Enterprise Security Teams Should Do Now
The Bing case offers a checklist most security teams can act on without buying any autonomous security testing platform. Start with anywhere an application accepts an uploaded image, thumbnail, or SVG file, and confirm what actually parses it under the hood. Many teams know their web framework well but have never audited the image library or delegate pattern sitting underneath it.
Treat image and file-processing helpers as untrusted input parsers, not internal plumbing. That distinction, drawn directly from this case, separates a library that gets patched on a normal cadence from one that quietly carries a decade-old vulnerability class forward into new products.
Audit service account privileges on any machine that touches that pipeline. SeImpersonatePrivilege and SeDebugPrivilege should not sit enabled by default on a worker process that only needs to resize a photo. Those two Windows privileges are what turned a single RCE into a path toward broader lateral movement inside Bing’s own fleet.
Finally, decide deliberately where autonomous AI penetration testing fits alongside existing bug bounty programs and manual pentest retainers, rather than picking one over the other by default. XBOW’s own numbers suggest autonomous tools are fast and cheap at breadth. Traditional manual testing and internal threat modeling still carry weight for judgment calls a validator script cannot make, including which findings actually matter to a specific business.
Five Predictions for Autonomous AI Security Testing
A few things look likely from here, based on where this story sits inside a broader pattern building since late 2025:
- More large technology companies will publicly credit an autonomous AI system, not just a named individual researcher, on their bug bounty leaderboards within the next 12 months.
- Another decade-old vulnerability class, similar to the ImageTragick-style delegate bug behind the Bing flaws, will likely resurface in unrelated software before the end of 2026, surfaced by AI-assisted fuzzing rather than manual review.
- Enterprise security budgets will increasingly carve out a specific line item for autonomous exposure validation, distinct from traditional penetration testing retainers, following Gartner’s AEV framing of the category.
- The AEV, breach-and-attack-simulation, and pentest-as-a-service categories will keep blurring together, and at least one acquisition should follow, with a larger platform vendor buying a smaller autonomous pentesting startup to round out its product line.
- Scrutiny of “fully autonomous” marketing claims will grow, pushed along by academic critiques already circulating, forcing vendors including XBOW to be more specific about exactly where human review still sits in their process.
What This Means Going Forward
Microsoft is not a careless target. It runs one of the largest bug bounty programs in the industry and employs thousands of engineers focused on exactly this kind of risk. That an autonomous system still found three Critical-rated bugs inside Bing’s image pipeline, using nothing more than a crafted file and a URL, is the detail that should worry every security team reading about it secondhand.
It should also reframe how boards and CISOs talk about AI penetration testing budgets for 2027 planning cycles. The technology is no longer a research curiosity chasing benchmark scores. It is now attached to two public CVE numbers, a named CVSS 9.8 rating, and one of the biggest targets on the internet. Whatever comes next in this category, it will be judged against that bar.
For more cybersecurity coverage, see our cybersecurity news archive.
Frequently Asked Questions
What is XBOW?
XBOW is an autonomous offensive-security company founded in 2024 by Oege de Moor. Its software runs penetration tests and vulnerability research with minimal human direction, and it became the first AI system to reach #1 on HackerOne’s US leaderboard in August 2025.
What vulnerabilities did XBOW find in Microsoft Bing?
XBOW disclosed three critical remote-code-execution flaws in Bing’s image-processing infrastructure, all rated CVSS 9.8. Two carry public CVE identifiers, CVE-2026-32194 and CVE-2026-32191, tied to a command-injection flaw reachable through Bing’s “Search by Image” upload feature.
Is the Bing Image Search vulnerability still exploitable?
No. Microsoft fixed the issue server-side, with CVE advisories dated March 19, 2026, months before XBOW published its technical account of the attack on July 23, 2026.
How did an AI system find this vulnerability without a human hacker?
XBOW uses a coordinator agent for reconnaissance, multiple specialized attack agents that work in parallel on different vulnerability classes, and a validator layer that confirms a bug is genuinely exploitable before it gets reported, with minimal step-by-step human direction along the way.
How big is the AI penetration testing market?
Estimates vary by firm and scope. Market Intelo sizes the autonomous AI penetration testing category at $2.8 billion for 2025, growing to a projected $9.7 billion by 2034. Broader penetration testing market estimates from Mordor Intelligence put the total category near $2.72 billion in 2026.
Who are XBOW’s main competitors?
Horizon3.ai’s NodeZero and Pentera both operate in adjacent territory, though they lean toward continuous security validation and breach-and-attack simulation rather than XBOW’s fully agentic exploit discovery. Gartner groups this broader space under the term Adversarial Exposure Validation.
What should companies do to protect against similar vulnerabilities?
Audit any pipeline that accepts uploaded images or SVG files, confirm what library actually parses them, and check for excessive privileges, such as SeImpersonatePrivilege or SeDebugPrivilege, on the service accounts running that code.
Did Microsoft pay XBOW a bug bounty for this discovery?
Microsoft credited XBOW with the find, and the discovery contributed to XBOW’s ranking on Microsoft’s bug bounty leaderboard, though neither company has published exact payout figures tied to these specific vulnerabilities.
