# Autonomous AI Hacker XBOW Uncovers Critical Remote-Code-Execution Flaws in Bing Images

*2026-07-29 22:01 UTC · AI · 1 min read*

> An autonomous AI security researcher from startup XBOW found two critical, unauthenticated remote-code-execution flaws in Bing Images, both rated CVSS 9.8 and already patched by Microsoft.

Security startup XBOW disclosed the technical details this week of two critical vulnerabilities its autonomous AI system found in Microsoft's Bing Images service, both allowing unauthenticated attackers to run commands on Microsoft's production servers. Tracked as CVE-2026-32194 and CVE-2026-32191, each carries the maximum CVSS severity score of 9.8.

The flaws exploited ImageMagick's delegate feature, which shells out to external programs to process certain file types. XBOW's AI crafted SVG images containing piped commands disguised as image references, tricking Bing's backend into executing them with NT AUTHORITY\\SYSTEM privileges on Windows servers and root access on Linux machines — no login, cookie, or click required.

Microsoft patched both issues server-side before the CVEs were publicly logged in March 2026, and XBOW held back the exploit mechanics until now at Microsoft's request. XBOW says it ran only benign, read-only commands during testing and touched no customer data. The firm, whose AI reportedly reached the top 10 of Microsoft's bug bounty leaderboard, says the case shows autonomous AI agents can now find server-side flaws as effectively as elite human researchers.

## Sources

- [thehackernews.com](https://thehackernews.com/2026/07/bing-images-flaws-let-crafted-svgs-run.html)
- [xbow.com](https://xbow.com/blog/bing-images-rce-vulnerabilities)

---
TechTools News · https://techtools.cz/tools/news/article/2096-autonomous-ai-hacker-xbow-uncovers-critical-remote-code-execution-flaws-in-bing
Česká verze: https://techtools.cz/tools/news/clanek/2169-autonomni-ai-hacker-xbow-odhalil-kriticke-chyby-umoznujici-vzdalene-spusteni