Xbow Raises $120M Series C to Scale Autonomous AI Hacking

An offensive security startup led by a former GitHub executive raised $120 million to strengthen its autonomous artificial intelligence-driven hacking technology.

See Also: OnDemand | Getting started with OpenTelemetry: Planning and tips for observability teams

The DFJ Growth and Northzone-led Series C financing will allow Seattle-based Xbow to automate penetration testing using AI agents, drastically reducing testing time while increasing frequency and coverage, said founder and CEO Oege de Moor. The company wants to improve efficiency through incremental testing and expand capabilities beyond web apps into mobile and native environments.

“We are an AI-native company that needs a lot of GPU power,” de Moor said. “We also would like to upskill the team itself.”

Xbow, founded in 2024, employs 190 people and has raised $237 million, having last completed a $75 million Series B funding round in June 2025 led by Altimeter. The company has been led since its inception by de Moor, who previously spent more than three years leading GitHub’s technology incubator and 13 years leading code analysis platform Semmle. Xbow is now worth more than $1 billion.

A Swarm of AI Agents Exploring Multiple Attack Vectors

De Moor said Xbow wants to increase its testing frequency to match modern development cycles, expand its coverage across web, mobile and native platforms, and deepen attack sophistication for AI-specific vulnerabilities. A significant portion of the funding is allocated to compute infrastructure, particularly GPU resources, which de Moor said is essential for running large-scale AI inference architecture.

“We proved the technology last year by entering HackerOne, it rose to number one in the world,” de Moor said. “That proved that autonomous hacking with AI is actually possible.”

Cyberattacks were historically limited by the availability of highly trained human hackers, but de Moor said AI removes that constraint, creating a world where attacks are more frequent, more sophisticated and the barrier to entry for attackers is dramatically lower. The traditional cadence of periodic, manual testing is fundamentally incompatible with the scale of AI-driven threats, de Moor said.

“A human hacker needs to learn a lot of things in order to do their work, and it’s a lot slower than doing it with a machine,” de Moor said. “So now, because AI is able to completely autonomously conduct these attacks, there are going to be way more attacks than before.”

Instead of a human tester sequentially probing a system, Xbow deploys a swarm of AI agents that simultaneously explore multiple attack vectors, which de Moor said reduces testing times from weeks to hours. The next step involves incremental testing, meaning that rather than retesting an entire system after every change, Xbow identifies what has changed and focuses only on those areas, de Moor said.

“Think of it as a swarm of agents all trying different attack types across the attack servers,” de Moor said. “By being able to do many of them in parallel, it can work much faster than a human pen test. So that gets the speed down to hours, and then in order to get it down yet further, a typical change only affects a couple of endpoints, or sometimes no endpoints at all. You don’t need to run a pen test after that.”

How Xbow Plans to Thwart Prompt Injection Attacks

Xbow’s focus on web applications was driven by both practicality and demand since web environments are more standardized and accessible, making them a natural starting point for automation. Xbow is now expanding into mobile and native applications, with the later presenting a more complex challenge due to deeper system-level vulnerabilities such as memory corruption, de Moor said.

“We started with web for economic and technical reasons,” de Moor said. “The economic reason is that everybody has web apps. Every organization has web apps. And so the need there is very urgent. It’s even more open because AI vibe coding makes it possible for everyone to create more apps. Typically, these web apps out there are being created as a tremendous rate.”

Prompt injection attacks manipulate AI systems into leaking sensitive data or executing harmful commands, de Moor said, with one AI system attempting to deceive the other. De Moor said Xbow is actively developing specialized agents to detect these vulnerabilities along with validators to ensure findings are accurate and reproducible. The attack surface is more nuanced and logic-based, he said.

“They’re having this conversation between AI systems, one trying to trick the other into do something it shouldn’t,” de Moor said. “But the special techniques for prompt injection are not yet very well known in the training set of the models.”

Security teams can guide the AI by providing credentials, scoping instructions and areas of focus, with humans directing its priorities and interpreting its findings, he said. The system maintains a detailed log of its reasoning and actions, allowing human experts to review and investigate deeper. In cases where the AI identifies something suspicious but can’t exploit it, humans can step in to complete the analysis.

“You can give the URL, you give credentials and then you can also give it all the details that you would give to the human pen tester when you have a scoping call,” de Moor said.