XBOW Features: A Full Breakdown of the Autonomous Hacker in 2026

XBOW (xbow.com) is an autonomous AI penetration testing platform that attacks web applications the way a human pentester would, then proves every finding with a working exploit. Its homepage leads with a boast it can partially back with public records, declaring “Anyone Can Claim to Be the Best AI Hacker. Only XBOW Can Prove It.”

Its public record is unusual for this category. XBOW ranked #1 on HackerOne above every human researcher, placed as the first autonomous system on Microsoft’s MSRC leaderboard, and counts 14,000+ zero days found in real customer applications, with 150+ security teams as customers.

All of that firepower points at exactly one layer, the running web application and its APIs. CodeAnt AI, the exploit-based agentic security platform whose AI agents reason across code, infrastructure, and runtime, anchors the comparison this breakdown runs throughout.

TL;DR: XBOW’s strength is autonomous exploitation with proof. Thousands of short-lived attack agents map a target, chain vulnerabilities into working attacks, and a separate validation layer confirms exploitability before you see a finding, with zero false positives claimed in its published 1,060-attack study.

>

The limits: it tests only web applications and their APIs, offers no SAST, SCA, secret scanning, or code review, never fixes code, runs SaaS-only, and gates SSO, API access, IDOR testing, and data residency behind the Enterprise tier. There is no free trial, and pricing went quote-only in mid-July 2026.

What Is XBOW?

XBOW is an autonomous penetration testing platform that uses fleets of AI agents to find, chain, and exploit vulnerabilities in web applications, then delivers each validated finding with a proof-of-concept exploit. The company reached #1 on HackerOne’s US leaderboard above every human researcher and became the first autonomous system ranked on Microsoft’s MSRC leaderboard.

The platform sums up the workflow in two blunt sentences, “Point it at a URL. Get back working exploits.” Everything else in this breakdown is the machinery behind that promise.

XBOW Features at a Glance

Every capability below comes from XBOW’s own site and documentation, re-verified in late July 2026, with the limit or availability gate beside it.

Notice how the table splits. The attack engine is genuinely broad, and nearly everything an enterprise needs around it, governance, integration, and residency, sits one tier up.

How Does XBOW’s Autonomous Pentesting Work?

XBOW runs a five-stage loop where you provide context, agents map and attack the target in parallel, and independent validators confirm what is real. The platform page names the stages Learn, Map, Coordinate, Attack, and Prove.

You start by pointing XBOW at a target with “whatever context you have: docs, credentials, API specs, architecture notes.” A live map of the attack surface follows, a coordinator “decides what to test, where, and in what order,” and then “thousands of agents attack in parallel,” reasoning through and chaining vulnerabilities with an offensive toolkit that includes a steerable headless browser.

The agents themselves are disposable by design, described as “short-lived, focused attack workers, retired after each mission to avoid bias.” Under the hood, XBOW “routes each task to the best model and adopts new frontier models as they ship,” so testing capability tracks the frontier without a migration project on your side.

Discovery separated from validation

The most consequential design decision sits between the attack and the report. XBOW’s research post states the split plainly, with “Creative AI discovers. Deterministic logic decides what’s real.”

A finding reaches you only after surviving controlled, non-destructive validation with a working exploit, which the platform frames as “eliminating false positives that can result from AI hallucinations.” The March 2026 study behind that claim, authored by XBOW’s Head of AI Albert Ziegler, covered 1,060 autonomous attacks on live HackerOne programs and reports zero false positives. Humans reviewed submissions “for compliance” and, in the study’s words, “did not participate in discovery or exploitation.”

Is XBOW Just a Vulnerability Scanner?

No. A scanner pattern-matches versions and configurations and hands you possibilities, while XBOW exploits what it finds and hands you proof, drawing the line in its own words as “exploitation, not pattern-matching.”

The difference shows up in the deliverable. Every finding ships with a proof-of-concept exploit and a trace of the whole attack, request by request, where DAST-style scanning leaves the validation burden on your team.

What Attack Types Does XBOW Run?

The official docs list seven default attack types run in every comprehensive assessment: local file inclusion, remote code execution, cache poisoning, open redirect, server-side request forgery, cross-site scripting, and SQL injection. Layered on top are checks for public and private CVEs, SSL/TLS issues, default credentials, exposed tokens and config files, information disclosure, and other misconfigurations.

Findings are grouped by CWE as selected by NIST’s National Vulnerability Database, each carrying a maturity label of Validated, Informational, or Preview. Read the labels carefully, because missing-authorization findings (CWE-862) are a Validated class while several authentication weaknesses (CWE-287, CWE-306, CWE-863) are Informational-only.

Optional attack types sit at the Enterprise tier: Insecure Direct Object References in public preview, and application-specific custom canaries. Enterprise users can also narrow a run to a subset of attack types, while everyone else gets the full default set.

How Does XBOW Handle Source Code and Testing Modes?

XBOW tests in blackbox, whitebox, or greybox modes, and in the whitebox and greybox cases you can upload source code as additional context for evaluating findings and selecting payloads. Reports then include the relevant code context.

Read that carefully, because it is the most misunderstood XBOW capability. Source code is an input that sharpens runtime attacks, never an asset that gets scanned, so there is no static analysis pass, no repository connection, and no code-level findings.

The distinction between that and SAST decides which half of the problem you have covered.

What Did XBOW Achieve on HackerOne?

XBOW submitted over 1,060 vulnerabilities across real-world production targets and reached #1 on HackerOne’s global leaderboard, above every human researcher. The published study documents what the agents did along the way, with no human in the loop for discovery or exploitation.

The specifics are the impressive part. Agents executed exploit chains up to 48 steps long, including escalating a low-severity blind SSRF into byte-by-byte file reconstruction, and broke a padding-oracle weakness in an AES-128-CBC implementation in 17.5 minutes.

Earlier public benchmarks showed XBOW matching a principal pentester’s 40-hour assessment in 28 minutes, before what the company says was another doubling in performance.

Microsoft’s MSRC leaderboard placement came with real CVEs, including three critical remote-code-execution flaws in Microsoft services disclosed in 2026 and a homepage claim no rival matches, “a 9.8 critical Microsoft flaw it found completely on its own.”

Customers echo the proof-first framing. Moderna’s Deputy CISO Farzan Karimi credits the chaining (“something no other product is doing well in the web space”) and the triage effect, saying “With XBOW, every finding comes with an exploit proof. That tells us exactly what to fix first.”

What Does XBOW Deliver After a Test?

Reports arrive compliance-mapped across what XBOW counts as 40+ frameworks, naming SOC 2, ISO 27001, HIPAA, ISO 42001, GDPR, PCI DSS, and NIS 2 on its platform page. Content is context-aware per vulnerability, with the exploit path, observed application behavior, code context where source was provided, remediation guidance, and a risk score.

Fix verification is a first-class assessment type, with a retest re-running the relevant attack types against previous findings. Note the fine print for an audit conversation: the framework language describes the reports XBOW produces for you, while XBOW’s own certifications sit behind its gated trust center.

Production safety runs through scope control, protected URLs that shield fragile systems mid-test, audit events for every action, and IP allowlisting. The docs also define what a target must be: fully functional, able to support multiple concurrent authenticated sessions, using activity-based session expiration, Chrome-compatible, and reachable from the internet or via allowlisted XBOW IPs.

Does XBOW Have an API?

Yes, though the title of its own reference carries the caveat, reading “XBOW API Reference (Preview),” latest version dated 2026-07-01. The marketing pitch is “Three Calls to Your First Finding,” covering registering an asset, launching a pentest, and fetching findings, with signed webhooks that push state changes so you are “pushed, not polled.”

Integration names are scarce beyond that. Microsoft is the only named third-party integration, in public preview, with a Sentinel connector that pulls findings into your data lake and Security Copilot support for querying findings and even running assessments via natural language.

SIEM, vulnerability management, and ticketing are otherwise named only as categories, so teams wiring pentests into CI/CD pipelines should budget for building against a preview-stage API.

Enterprise gates the rest of the operational surface. SSO, user roles, IP allowlists, and IdP group sync (public preview) are Enterprise-only, and data residency in the EU (Frankfurt) or Singapore is Enterprise-only private preview, with the default US console excluded as a residency option.

What Are XBOW’s Limitations?

None of this is a knock on what XBOW builds. Each limit below is the outline of what it deliberately does not do.

• One target class. Official docs scope testing to web applications and their APIs, with other target types on the roadmap, which leaves mobile apps, networks, cloud configuration, and infrastructure to other tools, mapped in our alternatives roundup.

• The code-security half is absent. No SAST, no software composition analysis, no secret scanning, no IaC checks, no code review, and no repo connection. XBOW proves your deployed app is exploitable and has no opinion on the pull request that made it so.

• Findings end at proof. You receive the exploit, the trace, and remediation guidance, and the fixing is your engineers’ work.

• Integration surface is young. A Preview-labelled API, no named SCM or ticketing integrations, and one public-preview Microsoft integration is thin plumbing for a platform selling continuous testing into enterprise workflows.

• The gates are steep. SSO, API access, IDOR coverage, attack-type selection, and data residency all require Enterprise, and since mid-July 2026 there is no published price, no trial, and no self-serve path, covered in full in our XBOW pricing breakdown.

• Staging must cooperate. The target requirements are sensible and still a real precondition many staging environments fail on the first attempt.

How Do XBOW’s Features Compare to CodeAnt AI?

The overlap is exactly one capability, proving exploits in running web applications. Everything else is complementary or one-sided.

Takeaway: buy XBOW to pressure-test the web applications you already shipped, with adversarial proof as the deliverable. Lead with CodeAnt AI when you want the exploit-proving and the prevention in one loop, with findings traced to code, fixed at the PR, and scanned continuously before and after deploy.

The full CodeAnt AI vs XBOW head-to-head runs this comparison finding by finding, and a sample pentest report shows what CodeAnt AI’s deliverable looks like.

Where This Leaves You

XBOW’s feature set is a focused, publicly validated attack engine: a five-stage autonomous loop, real exploit chains, deterministic validation, and compliance-mapped reports, aimed exclusively at web applications and their APIs. The caveats are the missing code layer, the preview-stage integrations, the Enterprise gating, and a buying process that now starts with a form instead of a price.

Pick by the gap you are covering.

If it is the deployed web app, XBOW belongs on your shortlist, with costs examined in the pricing breakdown and rivals in the alternatives guide. If the gap runs from the code outward, CodeAnt AI covers both halves and starts proving exploits on a URL for free today.