XBOW: Autonomous web penetration testing, top of HackerOne's US leaderboard
===========================================================================

XBOW is an autonomous penetration-testing system for web applications that became the first AI to top HackerOne's US leaderboard in 2025. It tests running services, not source code, and is listed here for completeness: it does not audit cryptographic libraries or circuits.

Maintainer: XBOW
Website: https://xbow.com
Category: Frontier-lab and general scanners
Targets: Web applications, Deployed services
Approach: Autonomous black-box penetration testing agent
Access: SaaS
Status: Active (155 million dollar Series C in 2026)
Strengths: Proven against real bounty programs. | No source access required.
Limits: Black-box web only. | Not a code auditor.
Firms using it: none listed
Sources: https://xbow.com

Source page: https://agentsast.com/tools/xbow/
Compiled by: agentsast editors (https://agentsast.com/about/)
Last reviewed: 2026-09-13