Agents Exploiting “Auth-by-One” Errors

Brendan Dolan-Gavitt, AI Researcher, XBOW & Vincent Olesen, AI Researcher, XBOW, speak at [un]prompted 2026 on: AI Agents for Exploiting "Auth-by-One" Errors. Modern web applications support a dizzying array of mechanisms to authenticate users and d...

Brendan Dolan-Gavitt, AI Researcher, XBOW & Vincent Olesen, AI Researcher, XBOW, speak at [un]prompted 2026 on: AI Agents for Exploiting "Auth-by-One" Errors.

Modern web applications support a dizzying array of mechanisms to authenticate users and determine whether they are authorized to access application resources. Unfortunately, these mechanisms are largely bespoke, and finding vulnerabilities in such systems has traditionally been the domain of human researchers.
In this talk, we will present techniques for finding—and, importantly, validating—access control flaws using AI agents. Starting with strict validators that can identify when we have successfully logged in to an account (for AuthN validation) and (for AuthZ validation) when we can access a protected resource, our key insight is that these validators allow us to build capable attack agents for exploiting auth vulnerabilities. We will demo these techniques by showing real-world examples of exploits we have discovered in production systems.