Brendan Dolan-Gavitt
@moyix.net
AI researcher at XBOW. Security, RE, ML. PGP http://keybase.io/moyix/
Such a cool exploit needs commensurately cool bling, so Alvaro (who wrote up the excellent post on this vuln) created this lovely little TUI so you can watch as it exfiltrates files from your server byte by byte
July 28, 2025 at 10:14 PM
Such a cool exploit needs commensurately cool bling, so Alvaro (who wrote up the excellent post on this vuln) created this lovely little TUI so you can watch as it exfiltrates files from your server byte by byte
So how do you precisely read a byte? Easy: you ask for the pixel histogram of a raw image consisting of byte [i...i+1] of the file. And you get back something like
histogram: [0, 0, 1, 0, 0], [59.8, 59.9, 60.0, 60.1, 60.2]
Telling you that the byte is ASCII 60 ('<')
histogram: [0, 0, 1, 0, 0], [59.8, 59.9, 60.0, 60.1, 60.2]
Telling you that the byte is ASCII 60 ('<')
July 28, 2025 at 10:13 PM
So how do you precisely read a byte? Easy: you ask for the pixel histogram of a raw image consisting of byte [i...i+1] of the file. And you get back something like
histogram: [0, 0, 1, 0, 0], [59.8, 59.9, 60.0, 60.1, 60.2]
Telling you that the byte is ASCII 60 ('<')
histogram: [0, 0, 1, 0, 0], [59.8, 59.9, 60.0, 60.1, 60.2]
Telling you that the byte is ASCII 60 ('<')
To decode it, XBOW had to realize that the file contents had been encoded using an encoding that stores pixels as deltas from the previous pixel. So cool!
July 28, 2025 at 10:12 PM
To decode it, XBOW had to realize that the file contents had been encoded using an encoding that stores pixels as deltas from the previous pixel. So cool!
This is one of the dumber reasons I've had some software fail: dying because it couldn't call ftruncate on /dev/null
May 14, 2025 at 7:48 PM
This is one of the dumber reasons I've had some software fail: dying because it couldn't call ftruncate on /dev/null
XBOW is growing and we're looking for talented folks to join us! Apply here: jobs.ashbyhq.com/xbowcareers
April 24, 2025 at 3:52 PM
XBOW is growing and we're looking for talented folks to join us! Apply here: jobs.ashbyhq.com/xbowcareers
Announcing CheatGPT, a revolutionary model that achieves SoTA on HumanEval! It's incredibly sample-efficient – just ONE training sample – and *tiny*, fitting on your Casio wristwatch!
![Snippet of python code implementing HumanEval's generate_one_completion(prompt) harness, and output from the HumanEval benchmark runner showing a pass@1 score of 94.5%.
[spoiler] The trick is that the "model" returns a Python object that overrides the equality operator and always returns true, causing the tests in the HumanEval test suite to pass.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:r5q2jrgxqoa2ovw6lz667it7/bafkreiem52ra4fbn5qc33rehniup2tcz26pqkbzg4kc76drpnj4i64ev3u@jpeg)
April 1, 2025 at 7:19 PM
Announcing CheatGPT, a revolutionary model that achieves SoTA on HumanEval! It's incredibly sample-efficient – just ONE training sample – and *tiny*, fitting on your Casio wristwatch!
Erin go bragh, cow go moo
March 18, 2025 at 1:42 AM
Erin go bragh, cow go moo
Not to brag but my brother has had TWO movies he co-wrote come out this year :D
March 8, 2025 at 6:29 PM
Not to brag but my brother has had TWO movies he co-wrote come out this year :D
Making security benchmarks for AI is tricky sometimes
February 17, 2025 at 1:46 PM
Making security benchmarks for AI is tricky sometimes
@xbow.com has been busy in the first few weeks of 2025 – our agent has autonomously found 106 vulnerabilities in OSS projects, and we've reported 72 so far! Amazing work by @nicowaisman.bsky.social and the security team triaging these and getting them into the disclosure->fix pipeline!
February 6, 2025 at 6:55 PM
@xbow.com has been busy in the first few weeks of 2025 – our agent has autonomously found 106 vulnerabilities in OSS projects, and we've reported 72 so far! Amazing work by @nicowaisman.bsky.social and the security team triaging these and getting them into the disclosure->fix pipeline!
Duck typing? You're thinking too small. With AI, we can finally take Guido van Rossum's dream to its logical conclusion
![Screenshot of Python code from the iPython interpreter:
class Person:
name: str
age: int
def __init__(self, name, age):
self.name = name
self.age = age
def __str__(self):
return f"Person(name='{self.name}', age={self.age})"
def __eq__(self, other):
prompt = f"Is:\n\n{self}\n\nbasically equal to:\n\n{other}\n\n?\n\nJust answer 'Yes' or 'No'"
response = client.messages.create(
model='claude-3-5-sonnet-latest',
messages=[{'role': 'user', 'content': prompt}],
max_tokens=16
)
return 'yes' in response.content[0].text.lower()
>>> Person('Brendan D-G', 41) == "Brendan Dolan-Gavitt, who is 41 years old"
True
>>> Person('Brendan D-G', 41) == "John Smith, a 25 year-old"
False](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:r5q2jrgxqoa2ovw6lz667it7/bafkreiboqhd6k7x72zl6cmveei55ldib425xu4efth5ekjf4ibtpqcexoa@jpeg)
January 6, 2025 at 9:16 PM
Duck typing? You're thinking too small. With AI, we can finally take Guido van Rossum's dream to its logical conclusion
hurts_just_a_little_bit.jpg
December 3, 2024 at 2:20 AM
hurts_just_a_little_bit.jpg
Do click through to the full trace too; it's very neat to see the details of how it reads through the code to identify vulnerable endpoints xbow.com#dockerhub-sr...
![Given that we're looking for potential SSRF or XSS vulnerabilities, we should examine the source code of key files that handle user input and URL processing. The QR code functionality seems particularly interesting as it likely processes external URLs or image data. Let's start by examining QrCodeService.php and related files.
$ cat /opt/resources/srv/app/Services/QrCodeService.php /opt/resources/srv/app/Api/v1/Controllers/QrCodeController.php /opt/resources/srv/app/Api/v1/Requests/QrCodeDecodeRequest.php
<?php
namespace App\Services;
use chillerlan\QRCode\QRCode;
use chillerlan\QRCode\QROptions;
use Illuminate\Support\Facades\Log;
use Zxing\ChecksumException;
use Zxing\FormatException;
use Zxing\NotFoundException;
use Zxing\QrReader;
class QrCodeService
{
/**
[Show More]](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:r5q2jrgxqoa2ovw6lz667it7/bafkreiejol4pg4nerfod75laixx37rrtrtmf3voa3i6frmvqedelm3sewm@jpeg)
November 22, 2024 at 4:51 PM
Do click through to the full trace too; it's very neat to see the details of how it reads through the code to identify vulnerable endpoints xbow.com#dockerhub-sr...
The Scoold developers were super responsive and published a fix quickly once we reported the issue! From the patch we can see what the root cause was – using an API that doesn't normalize paths when performing the access check: github.com/Erudika/scoo...
November 14, 2024 at 4:20 PM
The Scoold developers were super responsive and published a fix quickly once we reported the issue! From the patch we can see what the root cause was – using an API that doesn't normalize paths when performing the access check: github.com/Erudika/scoo...
3) I've also come to really appreciate how LLMs' breadth of knowledge lets them pull off cool exploits. I'd never heard of HOCON and I don't know much about Java servlets, but here XBOW manages to leverage HOCON file includes to read *arbitrary* files
November 14, 2024 at 4:18 PM
3) I've also come to really appreciate how LLMs' breadth of knowledge lets them pull off cool exploits. I'd never heard of HOCON and I don't know much about Java servlets, but here XBOW manages to leverage HOCON file includes to read *arbitrary* files
2) It did a great job reasoning here about how to make progress, and then executed on it really well with a Python script that systematically looks for path-related auth bypasses – and succeeds!
November 14, 2024 at 4:16 PM
2) It did a great job reasoning here about how to make progress, and then executed on it really well with a Python script that systematically looks for path-related auth bypasses – and succeeds!
There are a lot of cool moments in the full trace, but some of my favorites: 1) It only has a JAR file, but it is able to discover endpoints and RE the config file loader by disassembling the bytecode
November 14, 2024 at 4:13 PM
There are a lot of cool moments in the full trace, but some of my favorites: 1) It only has a JAR file, but it is able to discover endpoints and RE the config file loader by disassembling the bytecode
The vuln was pretty severe – it let unauthenticated attackers see the site config (including API secrets like these), modify the config to become admin, and even read arbitrary files on the server
November 14, 2024 at 4:12 PM
The vuln was pretty severe – it let unauthenticated attackers see the site config (including API secrets like these), modify the config to become admin, and even read arbitrary files on the server