Search

Gwendal Mognier

Gwendal Mognier is a Security Researcher at Escape. He’s passionate about cybersecurity and always eager to learn new ways to break and secure systems. Gwendal is focused on discovering vulnerabilities and helping improve security across the board.

Gwendal Mognier

Gwendal Mognier — Last Publications

Escape found the same XSS in two AI chatboxes. The vulnerability was in the Markdown renderer.

Offensive Security

Escape found the same XSS in two AI chatboxes. The vulnerability was in the Markdown renderer.

Weeks apart, at two unrelated companies, Escape's AI pentesting agent found the same stored XSS. Both had shipped a customer-facing chat where the model emits Markdown and the frontend renders it with raw HTML enabled and no sanitizer, so anything the model can be made to say executes in the browser of whoever reads the transcript next. Ask your own frontend team how many places in your product render Markdown that a model produced, and the honest answer is usually a number followed by "probabl

Gwendal MognierGeoffrey Diederichs

Gwendal Mognier, Geoffrey Diederichs

8 min read

Benchmarking AI Pentesting Tools: A Practical Comparison

Application Security

Benchmarking AI Pentesting Tools: A Practical Comparison

We benchmarked 4 AI pentesting tools: Escape, Shannon, Strix, and PentAGI against a modern vulnerable application. Learn more about their detection rates, false positive rates, and scanning speed.

Gwendal Mognier

Gwendal Mognier

12 min read

Methodology: How we discovered over 2k high-impact vulnerabilities in apps built with vibe coding platforms

Research

Methodology: How we discovered over 2k high-impact vulnerabilities in apps built with vibe coding platforms

Hey there, With Halloween around the corner, what’s scarier for organizations than vulnerabilities in their web applications? And it's even scarier when the development of these applications is in the hands of users not familiar with security practices. This year, the Escape research team has focused on a growing area of concern: vibe-coded applications. Purpose-built platforms like Lovable.dev, Base44.com, and Create.xyz have democratized application development, enabling non-developers to d

Nohé Hinniger-ForayGwendal MognierAlexandra Charikova

Nohé Hinniger-Foray, Gwendal Mognier, Alexandra Charikova

10 min read

Gin & Juice Shop Benchmark: How DAST Tools Really Stack Up

Application Security

Gin & Juice Shop Benchmark: How DAST Tools Really Stack Up

This month, we set out to compare our DAST against some of the established names in Dynamic Application Security Testing. We’ve already benchmarked our scanner on vulnerable apps like VAMPI and DVGA, and now we’re putting it up against Qualys, ZAP, and Intruder (available in free trial) on Gin & Juice Shop. Why are we doing this? Our scanner uses in-house built web crawling and business logic testing algorithms, designed from scratch to handle modern applications. Naturally, we get asked “How d

Gwendal MognierAntoine Carossio

Gwendal Mognier, Antoine Carossio

11 min read

Escape Blog Squad