{"id":"xbow--xbow-com","name":"XBOW","url":"https://xbow.com/","page":"https://mrpeppersdev.github.io/agent-infrastructure-landscape/systems/xbow--xbow-com","family":"agents","section":"Use-case-specific agent harnesses","sections":["Use-case-specific agent harnesses"],"tier":3,"last_verified_at":"2026-10-28","lifecycle":{"status":"active","severity":0,"note":null},"taxonomy":null,"cells":{"type":{"value":"Autonomous AI pentester (web app exploitation agent)","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"desc":{"value":"Sequoia-led $20M seed (Jun-2024); founded by Oege de Moor (Semmle / GitHub CodeQL founder). Autonomous offensive-security agent that finds and exploits web vulns end-to-end. Topped HackerOne leaderboard in 2025 (first AI on the leaderboard).","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"claims":{"value":"$20M seed Jun-2024 (Sequoia); $75M Series B Jun-2025 (Sequoia); topped HackerOne leaderboard 2025 as first AI participant","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"modalities":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"created":{"value":"2024 (founded)","citation":"https://xbow.com/","status":"real-data","tier":"T2","last_verified_at":"2026-05-14","source_class":"vendor"},"latest-release":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-13"},"license":{"value":"not applicable — not OSS","citation":null,"status":"not-applicable","tier":"T3"},"gh":{"value":"not applicable — no GitHub repo","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-13"},"mindshare":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-13"},"citations":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-13"},"funding":{"value":"$120M Series C Mar-2026 (over $1B val; led by DFJ Growth + Northzone)","citation":"https://xbow.com/news/xbow-raises-120m-to-scale","status":"real-data","tier":"T2","last_verified_at":"2026-10-28","source_class":"vendor"},"customers":{"value":"Stealth enterprise + bug-bounty programs","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"pricing":{"value":"Usage-based, scoped to environment (request a quote); available via AWS, Google, Oracle and Microsoft marketplaces","citation":"https://xbow.com/pricing","status":"real-data","tier":"T2","source_class":"vendor"},"compliance":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"data-handling":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"deployment":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"hq":{"value":"New York","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"founders":{"value":"Oege de Moor (CEO; founder of Semmle → GitHub CodeQL)","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"volume":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"perf":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"repro":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"code-release":{"value":"not applicable — not OSS","citation":null,"status":"not-applicable","tier":"T3"},"api-surface":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"latency":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"throughput":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"backend-storage":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"multi-tenancy":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"encryption":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"sso-rbac":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"embedding-model":{"value":"not applicable — not a memory product","citation":null,"status":"not-applicable","tier":"T3"},"consistency":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"versioning":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"tombstoning":{"value":"not applicable — not a memory product","citation":null,"status":"not-applicable","tier":"T3"},"schema-evolution":{"value":"not applicable — not a memory product","citation":null,"status":"not-applicable","tier":"T3"},"namespace":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"contradiction":{"value":"not applicable — not a memory product","citation":null,"status":"not-applicable","tier":"T3"},"forgetting":{"value":"not applicable — not a memory product","citation":null,"status":"not-applicable","tier":"T3"},"mcp-support":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"a2a-support":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"otel":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"webhooks":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"import-export":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"integration-count":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"orchestration":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"programmatic-control":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"vendor-benchmarks":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-13"},"pricing-specifics":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"agent-abstraction":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"memory-primitives":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"llm-lock":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"runtimes":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"session-handling":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"validated-verticals":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"time-to-running":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"anti-fit":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"optimised-for":{"value":"autonomous web-app pentest agents","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"adjacent-infrastructure":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"pros":{"value":"Topped HackerOne leaderboard as first AI; Sequoia-led; strong founder pedigree (Semmle/CodeQL).","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"cons":{"value":"Closed product; limited public details; benchmark dominance vs production OSS targets, not always real-world enterprise scopes.","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"links":{"value":"xbow.com/","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"obs-langsmith":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-opentelemetry":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-datadog":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-helicone":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-weave":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-langfuse":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-arize":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"obs-custom":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-token-budget":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-prompt-caching":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-semantic-caching":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-batching":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-model-routing":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-streaming-only":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"cost-observability-cost-attribution":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-langsmith-evals":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-braintrust":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-weights-and-biases-agent":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-helicone-evals":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-custom-test-harness":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-human-loop":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"eval-production-traffic-replay":{"value":"","citation":null,"status":"no-data","tier":"T3","last_verified_at":"2026-05-14"},"commit-trajectory":{"value":"not applicable — no GitHub repo","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-14"},"citation-trajectory":{"value":"not applicable — non-paper row","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-14"},"download-trajectory":{"value":"not applicable — not published as a package","citation":null,"status":"not-applicable","tier":"T3","last_verified_at":"2026-05-14"},"cost-input-usd-per-mtok":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"cost-output-usd-per-mtok":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"cost-tier":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"cost-pricing-model":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"cost-last-verified":{"value":"not applicable — wrong section","citation":null,"status":"not-applicable","tier":"T3"},"capability-composite-score":{"value":"74","citation":null,"status":"estimate","tier":"T3"},"capability-band":{"value":"competent","citation":null,"status":"estimate","tier":"T3"},"capability-benchmark-sources":{"value":"HackerOne leaderboard #1 AI participant (2025), general capability estimate — no specific benchmark recalled beyond HackerOne ranking","citation":null,"status":"estimate","tier":"T3"},"capability-last-verified":{"value":"2026-06-29","citation":null,"status":"estimate","tier":"T3"},"use-case-tags":{"value":"scoped-agentic, long-running-session, multi-agent-coordination","citation":null,"status":"estimate","tier":"T3"},"use-case-anti-tags":{"value":"memory-augmented-chat, latency-sensitive, offline-capable, code-generation-focused","citation":null,"status":"estimate","tier":"T3"},"adoption-accelerator":{"value":"","citation":null,"status":"no-data","tier":"T3"},"architecture-deployment-locus":{"value":"cloud","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"licensing-bucket":{"value":"commercial","citation":"https://xbow.com/pricing","status":"real-data","tier":"T2","source_class":"vendor"},"positioning-platform-vs-product":{"value":"product","citation":"https://xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"taxonomy-three-layer-rollup":{"value":"agent-infra","citation":"https://github.com/MrPeppersDev/agent-infrastructure-landscape/blob/main/docs/schema/section-to-three-layer-rollup.json","status":"real-data","tier":"T1","source_class":"repo"},"developer-activity-opendigger":{"value":"","citation":null,"status":"no-data","tier":"T3"},"freshness-date":{"value":"2026-10-28","citation":"https://mrpeppersdev.github.io/agent-infrastructure-landscape/systems/xbow--xbow-com","status":"real-data","tier":"T2","source_class":"catalog"},"compliance-certifications":{"value":"hipaa,soc2-type1,soc2-type2","citation":"https://trust.xbow.com/","status":"real-data","tier":"T2","source_class":"vendor"},"sdk-languages":{"value":"rest","citation":"https://xbow.com/api","status":"real-data","tier":"T2","source_class":"vendor"},"protocol-support":{"value":"","citation":null,"status":"no-data","tier":"T3"},"maturity":{"value":"","citation":null,"status":"no-data","tier":"T3"}},"corroboration":{"cited_cells":19,"third_party_cells":0},"edges":{"outgoing":[],"incoming":[]},"history":[{"date":"2026-10-28","commit":"42202517f6","pr":293,"kind":"update","changes":[{"field":"pricing","label":"Pricing","from":"not applicable — wrong section","to":"Usage-based, scoped to environment (request a quote); available via AWS, Google, Oracle and Microsoft marketplaces","source":"https://xbow.com/pricing"},{"field":"funding","label":"Funding / ownership","from":"$20M seed + $75M Series B Jun-2025 (Sequoia)","to":"$120M Series C Mar-2026 (over $1B val; led by DFJ Growth + Northzone)","source":"https://xbow.com/news/xbow-raises-120m-to-scale"}]}],"license":"CC-BY-4.0","source":"https://github.com/MrPeppersDev/agent-infrastructure-landscape/blob/main/data/landscape.json"}