Escape - Application Security & Offensive Security Blog
Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.
Filters
Research
Why does the rise of Agentic AI force security teams to become research-aware?
Bruce Schneier : "security is a process, not a product".
It’s not enough to audit your application once, every new feature introduces new attack surfaces that must be taken into account when evaluating the security of the application as a whole. For example, a company rolling out a
8 min read
Product updates
wp2shell (CVE-2026-63030 + CVE-2026-60137): WordPress pre-auth RCE, now detected by Escape
wp2shell is an unauthenticated RCE chain in WordPress core. It combines two separate vulnerabilities: CVE-2026-63030 and CVE-2026-60137. Escape detects it across DAST and AI Pentesting, confirms exploitability, and shows affected assets within its Attack Surface Management.
7 min read
DAST
Best AI DAST tools in 2026: ranked, compared, and reviewed for enterprise security teams
Every DAST vendor put "AI" on the homepage this year. The word now means ten different things to different tools, and even when discussing with analysts, they mention they give an "AI" badge when a certain capability checks the box. This is our attempt to fix
20 min read
Product updates
Fix issues with a prompt built for your coding agent
There's a translation step between a security finding and a fix, and it's usually done by hand.
Someone opens the issue, reads the description, checks the CVSS score, follows the link to the affected asset, works out which endpoint is actually involved, then writes all of
2 min read
AI pentesting
Modern AI-powered Pentesting Tools In-Depth benchmark
If you're evaluating AI for offensive security right now, you're weighing two questions at once. The first: why not skip the tooling and point a frontier model at your apps yourself? The second: among the AI pentesting tools you could actually buy, which one earns the
15 min read
AI pentesting
Two Critical Vulnerabilities, One AI Pentester: How Cascade Found an Unauthenticated RCE and Walked Around the WAF
TL;DR
We pointed Cascade, Escape's AI pentesting solution, at a single Spring + JSP customer portal. It came back with two findings that are typically difficult for traditional Dynamic Application Security Testing (DAST) scanners to detect:
* Unauthenticated RCE via SpEL injection. A ref request parameter was dropped, unsanitized,
11 min read
Case Study
How Escape helped Bridgetech Group replace pentests with automated evidence
Security scanning that doesn't feel like going to the dentist. See how Bridgetech Group uses Escape for authenticated security testing and API scanning, replacing costly manual pentests with customer-ready security evidence for ISO 27001 and enterprise procurement.
6 min read
AI pentesting
Introducing Cascade: the multi-agent penetration testing that becomes an expert in your business
Escape CASCADE allows you to run deep, human-grade assessments across your whole attack surface, proves every finding with a working exploit, and gets more expert in your business with every engagement.
15 min read
Agentic Pentesting
How Escape AI Pentesting Exploited SSRF in LiteLLM
At Escape, we routinely test the AI infrastructure that teams deploy inside their cloud environments.
LLM gateways, RAG pipelines, model proxies: these are services that make outbound HTTP requests by design, which makes them natural targets for SSRF.
When we looked at LiteLLM, we found three confirmed SSRF sinks, a
9 min read
Everything I Learned About Harness Engineering and AI Factories in San Francisco (April 2026)
I spent the last week of March 2026 in San Francisco talking to CTOs, CPOs, and engineering leaders from companies of every size about how they actually build with AI agents today. I've met solo founders of pre-series A startups, I attended Y Combinator DevTool Day on March
15 min read
API Security
Types of API security testing: a guide for enterprise teams
APIs account for a growing share of internet traffic, and attackers have noticed. In 2025, APIs accounted for 17% of all published security vulnerabilities, and 43% of newly added CISA Known Exploited Vulnerabilities were API-related, according to 2026 API ThreatStats Report. Between misconfigured authorization controls, exposed business logic, insecure API
22 min read
Escape raises $18M Series A to replace legacy scanners with AI agent-driven discovery, pentesting, and remediation
Led by Balderton Capital, with participation of Uncorrelated Ventures and existing investors IRIS and Y Combinator, the $18M Series A financing will accelerate our mission to multiply the impact of security teams through full-lifecycle offensive security.
4 min read
Don’t let your vulnerabilities escape.
Ready to multiply your force, not just noise?
Book a demo
Book a demo