XBOW wants proof. So it breaks in.

The login had failed. That was what the error message said, anyway. Beneath it, in the same response, sat a valid access token. PuppyGraph, a graph-query software company, had a door that announced it was locked while handing out the key. In January 2025, XBOW found the mistake and reported an authentication bypass and remote code execution. An earlier penetration test had missed it. PuppyGraph patched the problem.

That little contradiction explains the company rather well. A security tool can notice an error. A useful attacker asks whether the error means what it says. XBOW sells that second kind of curiosity, packaged as software that explores applications, develops attacks, and brings back evidence engineers can reproduce.

The man who had already automated half the job

Founder Oege de Moor had seen the gap from both sides. A former Oxford professor, he built Semmle, which GitHub acquired, and helped create GitHub Advanced Security and Copilot. At Semmle, software could identify suspicious code. Human researchers still had to establish how to exploit it. As he later explained in a Sequoia interview, that remaining manual step bothered him.

XBOW began in January 2024. Its founding circle brought together engineers from the original Copilot team and offensive security practitioners, including CISO Nico Waisman. The combination matters: generating a plausible attack is a language-model problem; deciding whether it actually worked is an engineering problem. The business needs both.

Early results were suspiciously good. De Moor wondered whether familiar security exercises had appeared in model training data. The team built fresh challenges. In his account, XBOW matched the strongest of five professional testers on 104 exercises, taking 28 minutes against the human's 40 hours. It was an encouraging laboratory result. Production software would demand a different examination.

A leaderboard is a very public laboratory

The progression was deliberate: training exercises, original benchmarks, open-source applications, then black-box targets on HackerOne. Each move removed a convenience. Eventually there was no source code to consult, and the organizations receiving reports could judge the work themselves.

The first bottlenecks were surprisingly ordinary. Bug-bounty rules were difficult to parse. XBOW says one program removed it because automated scanners were prohibited. Repeated copies of applications wasted effort, so the team grouped similar targets. Human researchers reviewed reports before submission under HackerOne's automation policy.

Those distinctions deserve to survive the marketing. An autonomous discovery process can still have human submission review. A duplicate can be technically real yet earn no credit. And a leaderboard measures performance inside particular programs, during a particular period. It cannot certify that every application has been exhaustively tested.

By August 2025, XBOW said the experiment had answered its founding question. The commercial priority shifted toward customer workflows, especially testing before changes reached production. HackerOne remained a testing ground for experimental capabilities. Winning attention had served its purpose; catching the next release's mistakes was the recurring job.

The useful part happens after discovery

In the product, a coordinator directs focused agents through an application. Customers supply targets and, where appropriate, credentials, documentation, or source code. Independent validators check whether proposed exploits reproduce. The platform returns the attack path, supporting evidence, and remediation guidance. After engineers deploy a fix, XBOW can test it again.

This places XBOW between scanners, human penetration-testing services, and application security teams. Its proposition is broader testing with less scheduling and less manual validation. That does not make every scanner useless or every human engagement redundant. XBOW's own comparison acknowledges work outside its remit, including physical and social engineering, and compliance engagements requiring a human signature.

PuppyGraph offers a concrete purchasing story. After the January finding and further critical discoveries in March, it moved its pentesting work to XBOW. A later assessment and report arrived in under two days, according to the customer account. Evidence changed the buying decision; delivery speed made repeated testing practical.

“Every XBOW agent is a new team member.”Leo Golovyrin, Application Security Lead, Seznam

Other public users include Moderna, Seznam, and Superhuman. XBOW's current website says more than 200 security teams use the platform. Its API lets customers trigger assessments from release workflows and retrieve findings. A March 2026 Microsoft collaboration introduced a public preview connecting assessments and results to Security Copilot and Sentinel data lake.

The price of getting there

XBOW sells usage-based coverage scoped to a customer's environment, with purchasing through cloud marketplaces. That makes the relevant buying question how much authorized application coverage a team needs, how often it will run assessments, and who will fix the results. More discoveries only help when someone can act on them.

Investors have funded that expansion heavily. A $75 million Series B in June 2025 brought disclosed funding to $117 million. Another $120 million arrived in March 2026 at a valuation above $1 billion; a $35 million extension followed in May. Together, those announcements imply $272 million raised.

Six days, with a footnote worth reading

In October 2026, XBOW described a Chrome exploit chain earning a $250,000 Google reward. The awarded chain took six days and $40,000 in compute, building on earlier work. A prior attempt included a bug Google already knew. Researchers had designed interchangeable stages, allowing a replacement chain.

This was human-directed research with AI agents, rather than evidence of an autonomous browser-testing product already on sale. Salaries and prior research also sit outside that compute figure. The copyable lesson is practical: build alternatives, verify results independently, and test your own software early. Success still depends on access, working credentials, clear scope, and people ready to repair what the machine proves.