{
  "slug": "xbow",
  "name": "XBOW",
  "tagline": "Autonomous web penetration testing, top of HackerOne's US leaderboard",
  "maintainer": "XBOW",
  "url": "https://xbow.com",
  "category": "frontier",
  "targets": [
    "Web applications",
    "Deployed services"
  ],
  "approach": "Autonomous black-box penetration testing agent",
  "license": "SaaS",
  "status": "Active (155 million dollar Series C in 2026)",
  "summary": "XBOW is an autonomous penetration-testing system for web applications that became the first AI to top HackerOne's US leaderboard in 2025. It tests running services, not source code, and is listed here for completeness: it does not audit cryptographic libraries or circuits.",
  "details": [
    "Relevant to a ZK or crypto product's web surface (APIs, dashboards, key-management portals), not to its cryptography."
  ],
  "strengths": [
    "Proven against real bounty programs.",
    "No source access required."
  ],
  "limits": [
    "Black-box web only.",
    "Not a code auditor."
  ],
  "fit": [
    "Use for the web layer around a cryptographic service."
  ],
  "references": [
    [
      "XBOW",
      "https://xbow.com"
    ]
  ],
  "category_name": "Frontier-lab and general scanners",
  "page": "https://agentsast.com/tools/xbow/",
  "updated": "2026-09-13"
}