Catalogue · Agents · offensive
XBOW
Offensive · Bug BountyConfirmed
First non-human to top HackerOne's US leaderboard. Autonomous pen-tester founded by Oege de Moor (creator of GitHub Copilot / CodeQL); Pentest On-Demand turns 35–100-day engagements into clicks.
Verified against xbow.com · 2026-06-16
Spec sheet
FoundationMulti-model (proprietary)
Topologyrecursive
Typeagent
Deploymentcloud
Interfaceapi
Scale#1 US HackerOne (Jun 2025) · ~1,060 vulns submitted · matched 40-hr pentest in 28 min · $237M raised
ToolsWeb exploitation · RCE/SQLi/SSRF/XSS
OrchestrationAutonomous pentest (recursive)
CountryUS
Verified2026-06-16
Sources
Verified against
https://xbow.com/blog/top-1-how-xbow-did-it The corpus does not rewrite vendor documentation. Where copy is quoted verbatim it is marked as such and attributed to its source.