XBOW Founder Spotlight | Altimeter Capital

How Autonomous AI Is Transforming Offensive Security

In this conversation, XBOW founder and CEO Oege de Moor explains how the company built a fully autonomous AI hacker capable of finding, validating, and reporting real vulnerabilities in web applications. XBOW’s rise to the top of HackerOne’s U.S. leaderboard marks a major milestone: for the first time, the highest-ranked white-hat hacker is a machine rather than a person.

De Moor describes XBOW as a force multiplier for security teams. It can complete work that traditionally takes human pentesters weeks in a matter of hours, while producing reproducible exploits, remediation guidance, and a detailed audit trail of every action taken. This makes it possible to move beyond annual or quarterly pentests and test applications continuously, including before every production release or directly within development workflows.

The discussion explores what makes XBOW possible: a combination of elite cybersecurity expertise, AI research, large-scale engineering, and extensive training data from capture-the-flag challenges and open-source applications. De Moor emphasizes that powerful language models alone are not enough. Autonomous hacking requires guardrails, specialized tooling, and coordinated swarms of agents that can divide tasks and share discoveries.

The conversation also addresses the risks of AI-powered offense. While XBOW is designed for defensive use, the same capabilities will inevitably reach malicious actors. De Moor predicts increased cybersecurity disruption in the near term, but believes defenders can ultimately gain the advantage by discovering vulnerabilities before systems are exposed.

Looking ahead, XBOW plans to expand beyond web applications into mobile, network, and client security, while developing agents that can automatically fix the vulnerabilities they discover. The broader vision is an AI-native application security platform that delivers validated outcomes rather than more alerts.