We've been using them to find novel vulnerabilities in open source web apps. The past 4 posts here have details: - Auth bypass/arbitrary file read in Scoold: h

We've been using them to find novel vulnerabilities in open source web apps. The past 4 posts here have details: - Auth bypass/arbitrary file read in Scoold: https://xbow.com/blog/xbow-scoold-vuln/ https://xbow.com/blog/xbow-scoold-vuln/ - SSRF in 2FAuth: https://xbow.com/blog/xbow-2fauth-ssrf/ https://xbow.com/blog/xbow-2fauth-ssrf/ - Stored XSS in 2FAuth: https://xbow.com/blog/xbow-2fauth-xss/ https://xbow.com/blog/xbow-2fauth-xss/ - Path traversal in Labs.AI EDDI: https://xbow.com/blog/xbow-eddi-path/ https://xbow.com/blog/xbow-eddi-path/ Each of those has an associated agent trace so you can go read exactly what the agent did to find and exploit the vulnerability.