XM Cyber Open-Sources Three Exposure Hunting Tools

Attack Path Analysis, Handed Over to Everyone

XM Cyber announced three open-source tools on July 29, 2026 that automate the kind of deep exposure analysis most security teams do by hand, badly, once a year. Two target Oracle Cloud Infrastructure permissions; one targets macOS privilege escalation. All three are heading to conference stages in early August — Black Hat USA Arsenal and DEF CON 34 — which is the traditional route for research tooling that a vendor wants used rather than sold.

• FAInd my XPC automates discovery and validation of privilege escalation paths in macOS XPC services, finding injectable applications and the privileged services they can reach
• pOliCI parses Oracle Cloud Infrastructure policies and computes effective permissions per principal, surfacing overprivileged identities
• A CLI Signing Helper extends the OCI command-line interface to test instance principal authentication end to end
• FAInd my XPC is slated for Black Hat USA Arsenal on August 5, 2026; pOliCI and the signing helper for DEF CON 34 on August 8, 2026

Why macOS XPC Is Worth a Dedicated Tool

XPC is how macOS processes talk to each other, and it is where a lot of privilege boundaries actually live. A helper running with elevated rights exposes an XPC service; a lower-privileged application talks to it; and the security of the whole arrangement rests on the helper correctly validating who is on the other end of that connection. When validation is incomplete, an attacker who can inject into a trusted application inherits the helper's privileges.

Finding those chains by hand means enumerating every XPC service on the system, working out which are reachable, checking each one's client validation, and then identifying which applications are injectable. It is tedious, error-prone, and exactly the shape of work that should be automated. As XM Cyber's Hillel Pinto puts it, the goal was to make "that deep, adversarial analysis more accessible and repeatable."

What Problem Do the Oracle Cloud Tools Solve?

The gap between what a cloud policy says and what it permits. OCI policies, like their equivalents on every major cloud, compose — group memberships, compartment hierarchies, dynamic groups, and inherited statements combine into an effective permission set that no single document displays. Reading the policies tells you the rules. It does not tell you what any given principal can actually do.

pOliCI closes that gap by computing effective permissions per principal, which turns "we think this service account is scoped correctly" into something checkable. The CLI Signing Helper covers the adjacent question of instance principal authentication — whether a compute instance's identity can be used the way an attacker would try to use it.

Both belong to a category that has quietly become the most valuable in cloud security: tools that answer *what is actually reachable* rather than *what is theoretically misconfigured*. A list of policy findings is noise. A demonstrated path from a low-privilege principal to a high-privilege action is a ticket someone will work this week.

Why Publishing Offensive Tooling Helps Defenders

It is a fair question, and the answer is about asymmetry. A well-resourced attacker already has this capability — building an XPC enumeration harness is a few weeks of work for someone motivated. The defender running a fleet of 5,000 Macs generally does not, because it is nobody's full-time job. Publishing the tooling moves the capability to the side that was missing it.

This is the same logic behind the open defensive tooling we have covered across our AI security work, from the Snowpick ServiceNow exposure scanner to the Open Secure AI Alliance's shared defensive stack. The consistent finding is that inspectable tools get adopted by teams who would never buy a product for the same job.

How to Put These to Use

Both toolsets are reaching security teams and researchers through a waitlist ahead of the August conference talks. The sensible order of operations for a defender: run pOliCI against your OCI tenancy first, because effective-permission drift accumulates silently and the findings tend to be immediately actionable. macOS XPC analysis is a longer engagement and more useful once you have an inventory of what elevated helpers your managed fleet actually installs.

Tooling like this arriving with talks attached is a good sign for the field. The research gets a public write-up, the code gets published, and the teams who need it most get it without a procurement cycle.

Sources: GlobeNewswire — July 29, 2026; XM Cyber — July 2026.