XBOW — first critical CVE discovered entirely by autonomous AI penetration testing agent
Date: 2026-03
Affected: Microsoft Devices Pricing Program; broader implications for AI-discovered vulnerabilities
Attack vector: other
Category: research-demonstrated
Severity: Critical
CVE: CVE-2026-21536

CVE-2026-21536, a critical vulnerability in Microsoft Devices Pricing Program, was discovered entirely by XBOW's autonomous AI penetration testing agent. XBOW agents have submitted 1,060+ vulnerabilities on HackerOne, executed 48-step exploit chains, and matched a principal pentester's 40-hour assessment in 28 minutes.

Impact: Paradigm shift in vulnerability discovery; 48-step exploit chains automated; 40-hour → 28-minute assessment

Mitigations:
Ethical guidelines for autonomous security testing
Rate limiting for automated vulnerability scanning
Responsible disclosure frameworks for AI-discovered vulnerabilities

Architectural layers (MAESTRO):
label: Agent Frameworks
notes: Autonomous AI agent discovers and validates vulnerabilities
role: origin
label: Security & Compliance
notes: First critical CVE attributed to autonomous AI agent
role: impact