Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-03-11 · source-backed
XBOW, a fully autonomous AI penetration testing agent, discovered CVE-2026-21536 — a critical RCE in Windows (CVSS 9.8) — entirely without source code access. This is one of the first CVEs attributed to a major OS that was found by an AI agent. XBOW has maintained a top-3 position on the HackerOne bug bounty leaderboard for over a year. This is the definitive "AI reaches parity with elite human pentesters" moment. The arms race is real: AI agents are now simultaneously the best vulnerability discoverers (XBOW) and the most dangerous attackers (Hackerbot-Claw). Builders deploying agents need to be on both sides. Krebs on Security
Each link below shares sources, entities, or timing with this story.
Claude Code criticizes Windows / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code criticizes Windows); both cover CVE, CVEs, CVSS, RCE; overlapping topics (agent, code, critical).
Codex released Windows / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Codex released Windows); both cover CVE, CVSS; overlapping topics (agent, code, cvss).
Shared entities / Shared topic / What happened next
Both cover CVE, CVSS, HackerOne, RCE; overlapping topics (agent, autonomou, critical, cve-2026-21536, cvss); picks up the CVE thread on 2026-03-15.
Codex released Windows / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Codex released Windows); both cover CVE, CVEs; overlapping topics (agent, attacker).
Linked by a graph relationship (Codex released Windows); both cover CVE, Security; overlapping topics (agent, code).
Claude Code criticizes Windows / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code criticizes Windows); both cover CVE, CVSS, RCE; overlapping topics (agent, code, cvss).
Claude Code criticizes Windows / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Claude Code criticizes Windows); both cover CVE, CVSS, Security; overlapping topics (agent, code).
Linked by a graph relationship (Claude Code criticizes Windows); both cover CVE, CVEs, CVSS; overlapping topics (agent, code).