An agent that hunts real vulnerabilities — only where it’s authorized.
Point HexHound at the programs you’re authorized to test. It recons the attack surface, reasons about what to probe and when, runs gated exploits safely, and proves every finding with a deterministic oracle — not a hunch.
- Scope-gated by design
- Deterministic proof, never the LLM
- Evidence for every finding
What it does
A tireless researcher that stays in scope.
HexHound is an autonomous agent for bug-bounty and offensive-security work. It behaves like a disciplined researcher: it learns a target, forms a theory, tests it carefully, and only reports what it can prove. The difference is that it does this across many authorized programs at once — and it never improvises outside the lines a program drew.
For bug-bounty hunters
Cover more programs without drowning in triage. HexHound surfaces proven, reportable findings with evidence attached, so your time goes to submission, not false positives.
For AppSec teams
Continuous, in-scope testing of your authorized surface. Deterministic confirmation means what lands in your queue is real — with the request/response trail to act on it.
How it works
The decision loop: recon → decide → probe → verify.
HexHound runs a closed loop. Each pass sharpens the next: recon feeds signals, signals update the attack-tree, the attack-tree picks the next gated probe, and the oracle decides what counts as a finding.
- 01 recon
Map the authorized surface
HexHound enumerates only what a program put in scope — hosts, APIs, auth flows, GraphQL schemas — and fingerprints the stack. Out-of-scope assets are excluded before a single request is reasoned about.
- 02 decide
Reason over a persistent attack-tree
Recon becomes signals. A persistent attack-tree ranks hypotheses by signal strength and cost, so the agent tests the right thing at the right time instead of spraying payloads.
- 03 probe
Run gated exploit probes
Only when a hypothesis clears its gate does HexHound probe — safely, with benign markers and rate limits. Every probe is scoped, logged, and reversible. Nothing destructive, nothing out of bounds.
- 04 verify
Prove it with a deterministic oracle
A finding is only real when a deterministic oracle — not the language model — confirms it. The oracle checks the actual security property, then writes an evidence bundle. The result: signal, not noise.
Capabilities
Built for signal, engineered for trust.
Persistent attack-tree
Hypotheses, signals, and outcomes persist across a run. The agent remembers what it tried, what it learned, and what to test next.
Deterministic proof
Findings are confirmed by code-level oracles that assert the security property itself — reproducible, auditable, and free of model guesswork.
Scope enforcement
Scope is a hard boundary, not a suggestion. Targets outside a program’s authorization are never recon’d, never probed, never touched.
Gated exploitation
Active probes are opt-in and gated per hypothesis. Benign markers, rate limits, and out-of-band confirmation keep every test controlled.
Evidence bundles
Each confirmed finding ships with requests, responses, the oracle result, and a drafted report — ready to triage or submit.
Breadth at speed
Parallel engagements across many authorized programs, continuously — the coverage of a team, without the false-positive backlog.
Put a relentless, in-scope researcher on your programs.
HexHound is in private beta. Request access and tell us which authorized programs you want covered.