XBOW chained three unknown Chrome bugs into a Windows exploit that runs on page load, built in six days with a public OpenAI model, it said. Google fixed all three and paid its $250,000 top reward; the fixes apply only after Chrome restarts.
Perspective Coverage
4 publishers
- Builder
- Builder 25%
- Operator
- Operator 41%
- Investor
- Investor 34%
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+30
- Incentives70
- Confidence72
buildOne report1 publisher AWS's pentest agent builds working exploits for 33 of 37 new CVEs from a URL and a hint
AWS says its Security Agent captured the flag through the intended vulnerability on 33 of 37 recently disclosed CVEs, with no proof-of-concept supplied. The test scores flag capture on containerized targets, so it measures skill and does not time disclosure-to-exploit.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives70
- Confidence55
Verizon's 43-day median patch time, against a five-day weaponization clock
Exploitation is now the top initial-access vector at 31% of breaches. The median defender needs 43 days to close a known-exploited flaw. Both figures reach operators through a guide selling the fix.
Reality
- Evidence45
- Adoption22
- Hype gap+40
- Incentives88
- Confidence58
Security executives want AI agent limits enforced downstream of the model
Agents show up in logs carrying the credentials of the employees whose authority they inherit. The security executives in a CSO Online account want their scope set by proxies, brokered tokens and downstream authorization before deployment.
Reality
- Evidence58
- Adoption32
- Hype gap+22
- Incentives76
- Confidence52
buildOne report1 publisher FAZE Security raises $6M to keep rerunning the exploit after the fix ships
Formerly CYTRIX, the company says more than 25 agents exploit, rank, route and then retest customer systems continuously. The accuracy and growth figures are self-reported, and the 0.1% false-positive rate comes without a sample or a period.
Reality
- Evidence30
- Adoption30
- Hype gap+40
- Incentives80
- Confidence58
A bug drought would push backdoor mandates back onto product roadmaps
Matthew Green argues AI patching will strand law enforcement without exploits to buy. Most practitioners TechCrunch asked think otherwise, and either way the thing a mandate reaches is your default configuration.
Reality
- Evidence44
- Adoption
- Not scored
- Hype gap+20
- Incentives78
- Confidence45
Northzone says the AI notetaker is dead. Its own portfolio is the tell
A VC that reviewed hundreds of AI productivity tools in a year says most are headed for the graveyard, and capital should rotate to drug discovery, defense and physical AI.
Reality
- Evidence20
- Adoption22
- Hype gap+46
- Incentives86
- Confidence44