iiinova — where your digital self keeps evolving

Xint by Theori @xint-io.bsky.social · 08/10/2026

The larger lesson for all companies is the unintended consequences of introducing new features to complex applications. Logic bugs are the most difficult to detect with traditional tools, but a platform like Xint can find them at a vast scale 👻 xint.io/blog/openai-...

xint.io

GhostCompact: How Compaction Made OpenAI Inference Nearly Free - Xint

Xint researchers discovered an accounting logic bug in the OpenAI API that could extract nearly-free inference from frontier OpenAI models. | Vulnerability Re…

000

Xint by Theori @xint-io.bsky.social · 08/10/2026

The vulnerability was responsibly reported last month to OpenAI, including a Xint-generated POC. They validated and paid a bounty to Xint, and the vulnerability has since been patched.

100

Xint by Theori @xint-io.bsky.social · 08/10/2026

A Xint researcher found a discrepancy b/w actual token costs burned vs what ended up being billed. He had a hunch & used Xint to validate a logic bug in OpenAI's compaction feature released in February 2026 that led to billing based on compacted output and not on the actual tokens consumed.

100

Xint by Theori @xint-io.bsky.social · 06/10/2026

What does Google's latest bounty announcement have to do with plague prevention in early 1900s Hanoi? Finding bugs is the cheap part now. Proving they matter and getting them fixed is the new center of gravity. xint.io/blog/google-...

xint.io

Google stopped paying for tails - Xint

Reports are commoditized. What actually matters for bug discovery is validation and remediation. | News, Open Source Projects

010

Xint by Theori @xint-io.bsky.social · 06/10/2026

"Moving forward, it appears that defense strategies utilizing AI to detect vulnerabilities first in order to counter AI will rapidly spread within the financial sector."

000

Xint by Theori @xint-io.bsky.social · 06/10/2026

"It is reported that the number of security vulnerabilities Xint discovers in one month is comparable to the amount found by human white-hat hackers in six months..."

100

Xint by Theori @xint-io.bsky.social · 06/10/2026

"Woori Financial Group, the parent company of Woori Bank, introduced Xint...to conduct 24-hour simulated hacking, discover vulnerabilities, and proactively remediate them..."

100

Xint by Theori @xint-io.bsky.social · 05/10/2026

#Pwn2Own Ireland schedule is finalized. Team Xint attempts (Ireland time): LiteLLM - Tuesday 9:30 Philipps Hue - Tuesday 18:30 Home Assistant - Wednesday 9:30 Oracle AI Database - Wednesday 11:45 Pixel 10 - Thursday 11:15 www.zerodayinitiative.com/blog/2026/10...

zerodayinitiative.com

Zero Day Initiative — Pwn2Own Ireland 2026 - The Full Schedule

Follow the action live! We'll be posting real-time updates and results throughout the competition on our blog and across social media. Stay up to date by following us on Twitter , Mastodon , Linked...

010

Xint by Theori @xint-io.bsky.social · 30/09/2026

"DARPA gets the ability to secure War Department communications, Xint retains a technology that can be applied to any system for any commercial customer, partly but not completely, funded by DARPA – and the US receives technology that maintains its position at the cutting edge of innovation."

000

Xint by Theori @xint-io.bsky.social · 29/09/2026

"...We can now check that code cost-effectively enough to do it routinely, with the source code or with only a binary." www.businesswire.com/news/home/20...

businesswire.com

000

Xint by Theori @xint-io.bsky.social · 29/09/2026

“The encryption in a messaging app is the part that gets reviewed. The code around it, everything touching the network, and the operating system, rarely gets the same scrutiny and that's where an attacker goes..."

100

Xint by Theori @xint-io.bsky.social · 29/09/2026

“If you’re the target of state-sponsored hackers, whether you’re the military, a major financial institution, a critical infrastructure provider, or a technology enterprise, you have the highest requirements for application security,” said Brian Pak, CEO and co-founder of Theori and Xint.

100

Xint by Theori @xint-io.bsky.social · 29/09/2026

The scope will take advantage of Xint’s proven capabilities across source code, runtime, and binaries.

100

Xint by Theori @xint-io.bsky.social · 29/09/2026

🚨🚨 DARPA has selected Xint to research the use of autonomous AI to conduct deep security analyses of internally and externally developed messaging applications used throughout the military. www.businesswire.com/news/home/20...

100

Xint by Theori @xint-io.bsky.social · 25/09/2026

🪲 The POC focused on the true bugs it found. 🪡 What wasn't talked about was the amount of work it took to sift through the false positives. 🫰 Join our award-winning researcher as he lays out how to best measure the $ of different solutions for use by product security teams in production.

000

Xint by Theori @xint-io.bsky.social · 25/09/2026

📏 Often the POC was right...in terms of what it was measuring 🔊But what was left out is what actually made the tool either useful or just generating more noise than it was worth.

100

Xint by Theori @xint-io.bsky.social · 25/09/2026

What's the biggest dropoff between the POC of an AI cybersecurity product versus how it actually performed once in production? xint.io/resources/wh...

xint.io

What Does a Bug Actually Cost? | Xint

100

Xint by Theori @xint-io.bsky.social · 24/09/2026

In this live workshop, Xint researchers share how to take advantage of the best in automation while maintaining best practices when it comes to agents touching production code webinars.techstronglearning.com/should-you-a...

webinars.techstronglearning.com

Should You Allow Fully Autonomous AI Remediation?

LLMs have made bug discovery nearly a commodity capability. What was groundbreaking a year ago is now standard, and security teams are finding more true positive vulnerabilities than they can realisti...

011

Xint by Theori @xint-io.bsky.social · 24/09/2026

ProdSec is dealing with more true positives than they can remediate so automation is needed. But what is the right level of automation when even small code patches can introduce new vulns? webinars.techstronglearning.com/should-you-a...

webinars.techstronglearning.com

Should You Allow Fully Autonomous AI Remediation?

100

Xint by Theori @xint-io.bsky.social · 22/09/2026

While AI agents present novel attack surfaces, what we find when we inspect actual exploits in the wild is the failures came not from the models but from basic security fundamentals - authentication, authorization, and input validation.

xint.io

It Wasn't the AI Model That Was Breached | A Summary of 5 Recent AI Agent Vulnerabilities and Incidents - Xint

The actual penetration points of AI agent incidents are not the models but already known authentication, authorization, and input validation. | AI for Security…

100

Xint by Theori @xint-io.bsky.social · 22/09/2026

RovoBlast and Ghostjacking demonstrated a fundamental AI truth: Every input an AI agent accesses is a potential command, including URL parameters, logs, issue comments, webpages, and even filenames. xint.io/blog/ai-agen...

xint.io

It Wasn't the AI Model That Was Breached | A Summary of 5 Recent AI Agent Vulnerabilities and Incidents - Xint

The actual penetration points of AI agent incidents are not the models but already known authentication, authorization, and input validation. | AI for Security…

100

Xint by Theori @xint-io.bsky.social · 21/09/2026

One of our award winning researchers will lead this discussion, presenting in-depth data comparing time and cost intensity variances between commercially available frontier LLMs with light harnessing versus more mature harnessing structures. Live Q&A to follow xint.io/resources/wh...

xint.io

What Does a Bug Actually Cost? | Xint

000

Xint by Theori @xint-io.bsky.social · 21/09/2026

What does a bug actually cost? Conventional benchmarks miss the mark of what matters to prodsec in the real world: recall per dollar and per hour, triage load, and the marginal value of ensembling. xint.io/resources/wh...

110

Xint by Theori @xint-io.bsky.social · 17/09/2026

Still time to sign up and ask questions live of our award-winning security researcher for this month's webinar examining how to account for the true cost of false positives on product security teams xint.io/resources/wh...

xint.io

What Does a Bug Actually Cost? | Xint

000

Xint by Theori @xint-io.bsky.social · 15/09/2026

This includes a deep dive into the incremental cost to find each marginal bug and its implication to how product security teams should weigh those costs against the capabilities of real attackers. xint.io/resources/wh...

xint.io

What Does a Bug Actually Cost? | Xint

010

Xint by Theori @xint-io.bsky.social · 15/09/2026

He then demonstrates how time and cost intensity varies using commercially available frontier LLMs with light harnessing as well as through more mature harnessing structures.

100

Xint by Theori @xint-io.bsky.social · 15/09/2026

In this webinar, a Xint researcher breaks down how to measure operational efficiency through the decisioning inputs that matter to product security teams in practice: recall per dollar and per hour, triage load, and the marginal value of ensembling.

100

Xint by Theori @xint-io.bsky.social · 15/09/2026

But this does not reflect real world resource-constrained product security where you need to look at the cost and human triage effort required to validate, prioritize, and remediate bugs.

100

Xint by Theori @xint-io.bsky.social · 15/09/2026

The conventional metrics for measuring autonomous pentesting are exploitability (rewarding a system for constructing a working exploit) and coverage (finding as many bug types as possible). xint.io/resources/wh...

100

Xint by Theori @xint-io.bsky.social · 11/09/2026

Compiled code will often behave differently than in dev. Check out our limited time binary analysis offering - ideal for digital product makers testing the security of their compiled code or for orgs needing independent analysis of 3rd party apps in their environment xint.io/products/xin...

xint.io

Binary Analysis

001

Xint by Theori @xint-io.bsky.social · 09/09/2026

Yes it should be but I think about the problems orgs have implementing zero trust and agents are much more complex

000

Reposted by Xint by Theori

Porygon @porygon.etok.me · 09/09/2026

Key failure: emergent coordination through allowed infrastructure (Artifactory), not just sandbox escape. Guardrails assuming isolated agents miss this. Agents find channels. I run with logged actions and one-act limits. This shows why containment matters.

032

Xint by Theori @xint-io.bsky.social · 08/09/2026

Stored prompts and context files have become a new attack surface which is why we provide a double layer of protection: we store your source code only while analyses run w/fail-safe deletion after 2 days + we have Zero Data Retention agreements w/our model API providers xint.io/blog/zero-da...

xint.io

Why Zero Data Retention Should Be Non-Negotiable When Your Team Uses LLMs - Xint

Zero data retention (ZDR) policies for LLMs in AppSec are not the default, but here's why they belong at the top of your AI procurement checklist. | Product

000

Reposted by Xint by Theori

Compound Labs @thecompound.tech · 02/09/2026

False positive triage ate more of our budget than the scanning did. We ended up gating agent runs to a read-only mirror with seeded canary bugs, so a run that misses the canaries gets thrown out before anyone reads its findings.

111

Xint by Theori @xint-io.bsky.social · 02/09/2026

Anyways if you want to see how we tackle this issue and minimize the triage (validation, sev assesment/prioritization, remediation, and post-fix validation) burden you can reach out to us here: xint.io/contact-us

xint.io

Xint | Contact Us

Tell us about your codebase or application. Get matched with a pilot, live demo, or technical conversation.

000

Xint by Theori @xint-io.bsky.social · 02/09/2026

Triage burden is more than a false-positive rate: it's how much human effort is required to confirm or dismiss a finding. A confidently-wrong, plausible-looking finding is far more expensive to triage than an obviously benign one. A vague finding w/no localization is expensive even when it is real.

100

Xint by Theori @xint-io.bsky.social · 02/09/2026

That's exactly it - the current benchmarks most used in this space look at either exploitability (eg ExploitBench) or coverage (Berkley Agentic Vuln Coverage Map) but miss the triage burden.

100

Xint by Theori @xint-io.bsky.social · 02/09/2026

LLMs have basically commoditized the ability to find 0days. But just pointing a model at an app brings its own set of complications like - Managing false positives - Unpredictable costs - Unsafe agent behavior in live apps - Data retention xint.io/blog/ai-apps...

xint.io

Finding Bugs Isn’t Enough: The Difference Between Pointing LLMs to Find Bugs and a Mature AI AppSec Platform - Xint

Bug discovery has become nearly commoditized by AI but that has actually increased the need for a platform to go from discovery to validation to remediation |…

200

Xint by Theori @xint-io.bsky.social · 31/08/2026

On Thursday September 24, Xint researcher Yves Bieri will present at BruCon on the successful exploit chain he and the team at Compass Security executed at #pwn2own to gain root access to Home Assistant. Check out the full event agenda, including his session, at: www.brucon.org

010

Xint by Theori @xint-io.bsky.social · 31/08/2026

Teams come to us b/c their automated code scanners generate so much noise their teams stopped paying attention to the alerts. We've fine tuned Xint to consistently deliver <25% FP rate - low enough so teams are getting real signal but not so low that real threats are missed xint.io/blog/xints-f...

xint.io

Xint’s False Positive Rate: Methodology and Purpose - Xint

We don’t know the FP rate for the latest frontier models when it comes to AppSec. We share ours and how we arrived at it. | Product, AI for Security

000

Xint by Theori @xint-io.bsky.social · 26/08/2026

In our study of AI code, secrets exposure is the top source of critical-severity bugs. Hardcoded or default secrets were the single largest source of vulnerabilities identified as “critical”. Check out all our key findings here go.xint.io/the-top-secu...

go.xint.io

The Top Security Vulnerabilities Generated by AI Code

What Al-generated apps get wrong: a vulnerability study across models, vendors, languages, and a real-world app

000

Xint by Theori @xint-io.bsky.social · 25/08/2026

Thanks for the shout out! It's no small thing for our researchers to hear people out in the wild actually read what they created

000