---
title: "XBOW, Offensive · Bug Bounty · Agent Fieldbook"
url: https://agentfieldbook.org/catalog/agents/xbow/
description: "First non-human to top HackerOne's US leaderboard. Autonomous pen-tester founded by Oege de Moor (creator of GitHub Copilot / CodeQL); Pentest On-Demand…"
section: "Catalogue · Agents · offensive"
source: Agent Fieldbook — generated from the published page
---

# XBOW

**Offensive · Bug Bounty · Confirmed**

First non-human to top HackerOne's US leaderboard. Autonomous pen-tester founded by Oege de Moor (creator of GitHub Copilot / CodeQL); Pentest On-Demand turns 35–100-day engagements into clicks.

Verified against [xbow.com](https://xbow.com/blog/top-1-how-xbow-did-it)· 2026-06-16

- [xbow.com](https://xbow.com/blog/top-1-how-xbow-did-it)

## Spec sheet

| Field | Value |
| --- | --- |
| Foundation | Multi-model (proprietary) |
| Topology | recursive |
| Type | agent |
| Deployment | cloud |
| Interface | api |
| Scale | #1 US HackerOne (Jun 2025)· ~1,060 vulns submitted· matched 40-hr pentest in 28 min· $237M raised |
| Tools | Web exploitation· RCE/SQLi/SSRF/XSS |
| Orchestration | Autonomous pentest (recursive) |
| Country | US |
| Verified | 2026-06-16 |

## Sources

- [darkreading.com](https://www.darkreading.com/vulnerabilities-threats/ai-based-pen-tester-top-bug-hunter-hackerone)

## Verified against

- [https://xbow.com/blog/top-1-how-xbow-did-it](https://xbow.com/blog/top-1-how-xbow-did-it)

The corpus does not rewrite vendor documentation. Where copy is quoted verbatim it is marked as such and attributed to its source.