I took the challenge.
Now let's fix it together.
The creator of XBI Panel posted a public dare: hack my AI-built hosting panel — demo licenses included. It made me laugh, I accepted… and 20–30 minutes later I had control of the server and its databases. I deleted absolutely nothing. This is the video, the story, and an open invitation.
$ curl xbipanel.com --public-challenge
→ “Hack my AI-built hosting panel. Demo licenses on me.”
$ accept_challenge --gladly
→ accessing… 20–30 minutes… server and database control ✔
→ backup copy extracted as evidence (private, never published) ✔
$ rm -rf ./damage
rm: ABSOLUTELY nothing was deleted or modified
$ next_step
→ responsible disclosure: 17-min video + invitation to talk
$
20–30
minutes from dare to server control
0
files deleted or modified
0
customer data published
17
minutes of video explaining everything
The story in four steps
What happened, exactly as it happened — no exaggeration, nothing exploited.
- The dare
An AI-built panel and a public challenge
The creator of XBI Panel shared the project — a complete hosting control panel built with Claude — and dared the community to hack it, handing out demo licenses for anyone to try.
- Minutes 0–30
The test: I sat down to play
I accepted the challenge in the best spirit. Between 20 and 30 minutes later I had control over the server and its databases, and even extracted a backup copy as evidence it could be done. That was the moment to stop playing.
- Afterwards
What I did NOT do
I did not delete or modify absolutely anything. I have not published, shared or sold any customer data. The copy and the full technical report remain private, available to the XBI team.
- Today
The invitation
I recorded a 17-minute video explaining in general terms what happened, and I am publishing this page with one simple message: let’s talk. I would love to help them secure the application.
Who is XBI Panel?
Direct screenshots of their official sites, so you know exactly who this story is about. Click to enlarge.
xbipanel.com — the landing
Their official page: “The hosting control panel for the AI era” — the product behind the public challenge.
clientes.xbi.es — the client area
Their client and licensing area, where the challenge’s demo licenses were handed out.
My code of honor in this test
Being a good security professional is not about getting in: it is about what you do — and refuse to do — once you are in.
Nothing deleted
I did not erase, encrypt or modify a single file. That is what ransomware does; professional security remediates, it does not destroy.
Nothing published
The data never saw the light of day: no forums, no pastebin, no sales. It still belongs to exactly whom it belongs.
Nothing kept
The access obtained was never reused or shared. The full technical report is delivered privately, only to the XBI team.
Zero mockery
Building a complete hosting panel is a huge achievement. This page is not a humiliation: it is a wake-up call delivered with respect.
The extracted backup copy exists solely as evidence of the finding and will be returned or destroyed whenever the XBI Panel team requests it.
Evidence of the path
Three real screenshots of the access, exactly as taken and with nothing to hide: they expose no customer data or credentials. Click each one to view it large.
Inside the admin panel
The panel’s admin console going through the hosting’s managed nodes.
Server file manager
The file manager browsing the server root: /root, /etc, /var, /home…
Root console on the node
A root shell on a production node, with the backup copies in sight.
Screenshots published as-is, verified: no readable customer data or credentials. The full technical report, with all the detail, is delivered privately to the XBI Panel team.
The video: 17 minutes, no drama, nothing exploited
Shot vertically on a phone: what I found, how I saw it in general terms, and why the hack itself is not the important part — what comes after is.
Deliberately, the video contains no exploitable technical details: the full report — with evidence and a remediation plan — is delivered privately to the XBI Panel team.
An open letter to the XBI Panel team
Hi. First of all: genuine congratulations. Building a complete hosting control panel — API, agent, store, mail, databases, dozens of CMS installers — is something most teams never achieve. And using AI to speed up development is not a weakness: it is the present of this industry.
What happened does not mean your product is bad. It means that code which manages servers, mail and third-party data needs human security review and adversarial testing before going near the open internet… and long before inviting the internet to try it. In fact, your own package already shipped security audits with documented findings: the awareness was there; the open items just needed closing before the dare.
This time it was someone who deleted nothing, published nothing and only wants to help. Next time — and with a public challenge, there will be a next time — it might not be. Write to me: the full report is yours, free of charge and with no strings attached. And if you want, we can build the remediation plan together.
— Jesús, Soporte Server
Three lessons for anyone building with AI
What this story leaves the community, beyond the challenge.
01
AI writes, you answer
AI generates code at incredible speed, but it does not carry the responsibility. Audit and adversarially test everything that touches infrastructure or third-party data before shipping it.
02
A panel is the master key
A hosting panel concentrates the server, mail, DNS and databases of all your customers: one critical flaw compromises all of them at once. Security is not a module; it is the foundation.
03
A public dare ≠ a security strategy
Inviting the internet to hack your product without prior pentesting or a responsible disclosure channel is leaving the door open and trusting strangers’ manners. This time we got lucky. Do not make it the plan.
Ready to Optimize Your Infrastructure?
Our specialized team is ready to analyze your needs and propose the best solution for your company. First consultation completely free.