BenefitsHow it works
FAQsTeam
LoginBook a demoBook a demo

All Resources

Whitepapers

Long-form research from the Shinobi team. No gated downloads, no email walls — just the work.

WHITEPAPER // 2026

Shifting OffSec Left with Agentic AI

From reactive scanning to continuous offensive validation. Why shifting scanners left did not shift attacker-like testing left, and what a credible path forward looks like.

Agentic AI
Shift Left
Offensive Security
AppSec
Continuous Pentesting
Read

Blogs

In-depth articles on AI-powered security, penetration testing, and real-world vulnerability discoveries.

Redis
CVE-2025-49844
Tenant Isolation

FEATURED

The CVE Needed a Patch. The Platform Needed a Redesign.

A public Redis exploit targeted the wrong build. Shinobi adapted it, proved remote command execution, and uncovered a tenant-isolation failure that a Redis upgrade alone would not fix.

Varun Uppal

Varun Uppal

15 min read

CVE-2026-70478
CVE-2026-41278

Bug of the Week: You shared your chat, so I read your email!

A helpdesk bot on your intranet, wired to the shared mailbox and calendar. Two unauthenticated HTTP requests, and anyone who can open the page is holding a live OAuth token for the accounts behind it.

David Mound

David Mound

6 min read

HackerOne
Bug Bounty

We Didn't Build Shinobi to Top the HackerOne Leaderboard. But It Did

What happened when we put an AI pentester into one of the most competitive offensive-security environments available.

David Mound

David Mound

9 min read

More Articles
AI
Penetration Testing
Ensuring Safe AI Pen Testing: A Chat with Team Shinobi

Learn how AI can safely conduct penetration testing with expert insights on guardrails, risk management, and more.

Varun Uppal

Varun Uppal

8 min read

Compliance
iGaming
Bug of the Week: Betting on Compliance Controls That Stopped at the Front End

A licensed sportsbook accepted bets carrying a DENIED geolocation verdict. The SDK worked. The token was signed. The backend just never enforced the decision.

David Mound

David Mound

9 min read

Prompt Injection
Compliance Bypass
Bug of the Week: How a 30-Word PDF Approved Unsafe Products for Shipment

A crafted PDF containing 30 words of plain text bypassed the entire product compliance validation pipeline at a global retail organisation. The LLM read the document, accepted the injected instructions as fact, and approved non-compliant products for shipment.

David Mound

David Mound

10 min read

MFA
Authentication
A Pentest That Skips MFA Is Fiction

How Shinobi's AI agents handle email and SMS authentication without weakening your security posture.

Priyank Gupta

Priyank Gupta

6 min read

Fix Verification
Exploit Replay
One-Click Fix Verification

How long a developer waits to find out whether their patch actually worked directly determines how long their software stays vulnerable. Shinobi shrinks that window to a single click.

Varun Uppal

Varun Uppal

7 min read

Zendesk
Misconfiguration
Zendesk Chat Attachments: An Insecure Default Worth Checking

While working with a client, we discovered that Zendesk's chat widget allows unauthenticated access to file attachments by default. Here's what we found and how to fix it.

David Mound

David Mound

12 min read

Vulnerability Chaining
Post-Exploitation
Introducing Aggressor Mode

Finding vulnerabilities doesn't make systems secure — showing their impact does. Aggressor Mode transforms Shinobi into an unrelenting adversary that chains vulnerabilities and demonstrates maximum realistic impact.

Varun Uppal

Varun Uppal

10 min read

Business Logic
Vulnerability Chaining
Chaining Five Business Logic Flaws to Steal $999,999

How an AI Pentester Found What Scanners Can't ... and most humans would miss

David Mound

David Mound

14 min read

DAST
Application Security
Rethinking Application Security Testing: From DAST Scanners to AI-Powered Pentesting

DAST scanners were built to scale vulnerability detection, not adversarial reasoning. This post explores how AI-powered pentesting changes application security testing by focusing on real-world attack paths and risk.

Varun Uppal

Varun Uppal

4 min read

LLM Security
Prompt Injection
Leaking OpenAI's Hidden GPT-5 System Prompt via Context Poisoning

A post-mortem on a critical vulnerability where a "smarter" reasoning model was tricked by a fundamental architectural flaw. What is "Juice: 64"?

Abhishek Gehlot

Abhishek Gehlot

12 min read

Mobile Security
Automation
Meet the world's first AI-powered mobile app pentester

Shinobi can now pentest mobile apps with same skills and precision of traditional pentesting... but does it faster and continuously

Varun Uppal

Varun Uppal

6 min read

IDOR
Privilege Escalation
One Parameter to Rule Them All: How a User Flaw Unlocked an Admin Fortress

How Shinobi exploited a single vulnerable parameter in an EV charging platform to cross security boundaries and gain full administrative access.

Abhishek Gehlot

Abhishek Gehlot

9 min read

Authorization
IDOR
The Ghost in the API: How Shinobi Turned a Single Flaw into Super Admin Access

A journey through an IoT platform where learning from rejection led to uncovering a complete authorization breakdown and a hidden Super Admin account.

Abhishek Gehlot

Abhishek Gehlot

10 min read

IDOR
Data Privacy
More Than an Invoice: How Shinobi Averted a Child Safety Crisis

How an AI pentester turned a routine test on a holiday camp booking app into the prevention of a serious child safety and data privacy incident by uncovering a critical IDOR vulnerability.

Abhishek Gehlot

Abhishek Gehlot

8 min read

SAST
DAST
AI Pentesting VS AI Code Scanning

A bakeoff between a next-gen pentester and code scanner reveals why testing live applications still uncovers vulnerabilities that code scanning alone can't catch.

Varun Uppal

Varun Uppal

6 min read

Logic Flaws
Business Logic
Using AI to find logic flaws

How an AI Agent discovered a business logic flaw in a Popular Web Application by thinking creatively and connecting the dots like a human pentester.

Abhishek Gehlot

Abhishek Gehlot

10 min read

Videos

Behind the scenes at Shinobi — demos, deep dives, and research behind autonomous pentesting.