Home
Three vulnerability classes I’ve spent most of my career testing for turned up at Black Hat and DEF CON this year, wearing AI costumes. CSP bypass. SSRF. HTML injection race conditions. Every one of them was written off as solved; every one of them was reachable again.
The clearest example was SearchLeak, disclosed by Varonis Threat Labs and presented at DEF CON 34. The chain has three links. A URL parameter in Microsoft 365 Copilot Enterprise Search gets passed to the model as an executable prompt. The model emits an <img> tag that the browser renders mid-stream, before the output sanitizer runs. The image source points to Bing’s Search-by-Image endpoint, which is allowlisted in the page CSP and performs a server-side fetch to an attacker-controlled host.
Victim clicks a microsoft.com link. Copilot searches their mailbox, calendar, SharePoint, and OneDrive. The data leaves through Microsoft’s own infrastructure. Microsoft rated it critical and assigned CVE-2026-42824.
Pull that chain apart, and two of the three links are bugs any of us would have triaged as low ten years ago. A sanitizer that runs after render. An allowlisted domain that will fetch arbitrary URLs. On their own, barely worth a ticket. Composed with a model that follows instructions, they exfiltrate an inbox.
Chaining for less
The second thing worth your attention is how cheap chain discovery got.
James Kettle’s HTTP Terminator, an AI research system built around his own desync methodology, explored 30,000 candidate desync vectors and tested across 30,000 authorized sites, flagging roughly 700 vulnerable targets. Banks, government infrastructure, security products, and an airport. The system generated new desync techniques on its own, but Kettle’s strongest results came when he stepped back into the loop. The model proposed a new vulnerability class, which Kettle calls Shared-Parser Confusion, and he confirmed and generalized it. One researcher’s method, with AI doing the legwork, reached internet scale.
Two weeks before Black Hat, a Searchlight Cyber researcher published a pre-authentication RCE chain in WordPress core found with about $25 of AI usage and just over ten hours of runtime. A batch API validation desync opened a pre-auth SQL injection. From there, the model poisoned the post cache, abused a customize_changeset to borrow the administrator’s identity, and replayed the request through a hook to create a new admin account. The researcher’s own verdict is that no security researcher could have found and finished that chain in ten hours without AI.
For anyone running an AppSec program, the gap between “an attacker could theoretically chain these four lows” and “someone did it on a lunch budget” is now closed.
What the numbers say
Akamai’s 2026 State of the Internet report on apps, APIs and DDoS backs this up:
- 61.18% of API attacks in 2025 involved unauthorized workflows and abnormal activity, up from 30.01% in 2024. Akamai reads it as attackers moving off familiar exploits like SQL injection toward logic-based abuse of how APIs handle business processes.
- 87% of organizations had an API-related security incident in 2025.
- Average API attacks per organization per day hit 258, up 113% from 121 the year before.
Behavior-based abuse doubled its share in twelve months. None of it produces a malformed request, which means signature-based tooling has nothing to fire on.
Where this actually lands
Testing cadence is the real gap
Annual and semi-annual testing was designed around annual and semi-annual releases. Nobody ships that way now. A two-week engagement scoped to three applications tells you those three applications were secure in March, while the team pushed to production two hundred times between then and now.
Most organizations do have continuous coverage of some kind. WAF, SAST, dependency scanning. What they don’t have is anything proving exploitability across the rest of the surface between engagements, so scanners fill the calendar with volume instead. Long lists of theoretical findings, mostly unreachable, which is how a triage backlog reaches four figures and stays there.
Testing needs to run at deployment speed. That’s the problem FireCompass was built for.
How our agents handle it
We put that last claim in public rather than in a datasheet. Three months on a live authorized bug bounty program, $5,000 a month all in, including tokens, cloud, and human review. Our agents reached #1 on HackerOne’s OWASP A01 board for the quarter, #2 for highest critical reputation, and #3 on the US country board. Critical and high findings were 64.4% of everything severity-rated.
A01 is broken access control. Business logic, scored against human researchers, on production targets.
Guardrails
Agents chaining exploits against production need limits, and this is the question that comes up in every second meeting.
Try it against your own surface
SearchLeak chained two low-severity web bugs into an inbox breach. Kettle’s AI-assisted system found roughly 700 vulnerable hosts. A WordPress pre-auth RCE cost $25 to discover.
Your perimeter is being tested at that cadence whether or not you’re testing it yourself.
FireCompass offers a free trial. Point it at your external attack surface and see what comes back with a working proof of concept attached.
