XBOW's autonomous pentesting agent reached #1 on HackerOne's US leaderboard

What the agent does

XBOW scans web applications in bug bounty programs, tries attacks, and writes reports for the issues it confirms. Humans check the reports before they go out.

Why this works

XBOW's team credits deterministic validation: each finding is checked by code (for example, proof that an injected payload ran), not by asking an LLM if it looks real. This cuts false positives, which bug bounty programs punish.

What to copy

• Never let the model grade its own findings. Use a checker that proves impact.
• Keep a human approval step for anything sent to a third party.
• Start with one vulnerability class you can validate fully.

Starter prompt

Written by us. Only test systems you are authorized to test.

Target: {in_scope_url}. Scope rules: {program_rules}.
Vulnerability class: reflected XSS only.

For each input you test:
- Use the harmless marker payload {marker}.
- A finding counts only if the validator script confirms the marker
  executed in the browser. Paste the validator output.
Stop and ask before testing anything outside scope.