XBOW's AI agent finds critical unauthenticated RCE in EAC voting calculator, fixed before midterms
moyix · x · 2026-10-29
XBOW disclosed that its autonomous pentesting agent found a critical, unauthenticated RCE in a public EAC election resource calculator web app. A crafted request allowed root-level code execution in the backend container with access to protected resources and outbound network. Reported under EAC's vulnerability disclosure policy and fixed ahead of the Nov 3, 2026 midterms. The team runs XBOW against real bug bounty programs as QA, arguing production stacks and business logic expose failure modes synthetic benchmarks can't reproduce.
More from coding & agent
- Weaviate Podcast: MIT PhD's "Machine Studying" lets always-on agents prep without knowing the task — CShorten30 · 2026-10-29
- Dev rebuilds Slack as video with Cursor agents and computer use — mattyp · 2026-10-29
- Deepgram acquires Daily, spins up independent Pipecat Foundation — charles_irl · 2026-10-29
- Don't force multi-agent for enterprise: a one-night RPA script beats slow, costly agents — sujingshen · 2026-10-29
- After 30 approval prompts, 'yes' to everything sent a broken release to his whole list — latent_lurker8587 · 2026-10-29
- Nat Eliason builds a personal AI writing system in one Claude Code session — nateliason · 2026-10-29