AI Pentest Agent Reaches HackerOne's Top 3 on a $5,000-a-Month Budget

A three-month live experiment by FireCompass reached top-three positions across multiple HackerOne leaderboards, on a $5,000 monthly budget, less than a junior pen tester's salary.

BOSTON, July 28, 2026 /PRNewswire/ -- The cost of advanced offensive security is falling fast. In a three-month experiment on a live, authorized global bug bounty program, FireCompass AI reached top-three positions across multiple HackerOne Business leaderboards while operating on a budget of $5,000 per month.

The experiment was run by FireCompass, a company that builds autonomous AI agents for penetration testing and red teaming. It was conducted against live production targets, not in a lab. Peak rankings achieved are as follows:

• No. 3 on HackerOne's U.S. country board (Last Quarter)
• No. 2 for Highest Critical Reputation (Current Quarter till date)
• No. 1 in OWASP A01(last quarter)
• No 1 in Up and Comers Category (Current Quarter)

For leaderboard screenshots and more details: www.firecompass.com/blog-ai-penetration-testing-hackerone-top-3

How cheaply can AI reach the world's top 3?

The experiment started with a budget of $5,000 per month, inclusive of AI tokens, cloud, and human oversight costs. FireCompass created a pipeline of its own AI agents and built an automated pipeline to discover and report vulnerabilities.

FireCompass' harness engineering had multiple frontier models coupled with its purpose-built small language models created by FireCompass. The safety controls included:

• Hard enforcement of each program's authorized scope
• Non-destructive validation of vulnerabilities
• Limits on request rates, concurrency, and blast radius
• Proof of exploit for every submitted finding

Top 3 for $5,000-a-month, less than the salary of a junior pen tester

Bikash Barai, Founder and CEO of FireCompass, said: "Our agents had already reached 100% on the benchmarks we tested. This experiment was about what it costs to get into the Top 3 spots in a global bug bounty leaderboard. We reached there with just $5K per month. What it means is that threat actors with a very small investment can be as powerful as the world's top hackers. This is an opportunity for defenders, but the same economics reach attackers at the same time. The next challenge is not just building more powerful AI. It is engineering the controls, safety, and accountability around it."

The system submitted 150 reports in the primary April to June window and 204 across the full experiment. The disposition of those findings:

• 19 reports (12.7%) were accepted as triaged or resolved.
• Critical and high severity findings together were 64.4% of severity-rated findings.
• 58 reports (38.7%) were real vulnerabilities that another researcher had already reported before us, so FireCompass did not receive credit.
• 18 reports were still under review at the close of the experiment.
• The "not applicable" rate: 0% among critical-severity findings and 4% among high-severity findings.

The falling cost of offensive capability

Bruce Schneier, security technologist, author, Harvard lecturer, and FireCompass advisor, said: "The history of security is a history of falling costs. When a capability gets cheap, everyone gets it at once, defenders and attackers alike. This experiment shows offensive AI has crossed that line. The question is no longer whether AI can find real vulnerabilities cheaply; it plainly can. The question now is whether defenders adopt the same capability fast enough, and deploy it with safety and discipline."

An AI system can now perform meaningful parts of advanced penetration testing at higher speed and larger scale. The same cost reduction is available to both attackers and defenders. FireCompass expects the cost to keep falling as model and compute prices decline.

"We invested in FireCompass because we believed in the vision of their exceptional team, and the conviction that AI will empower the cybersecurity professionals who defend this industry, not replace them. FireCompass reached the top 3 on HackerOne, and they did it without using any low-cost Chinese models. The future of offensive security testing is not AI replacing cybersecurity professionals. It is AI-powered professionals," said Jay Bavisi, Group President, EC-Council, the creator of CEH, the largest certification organization for penetration testers.

Methodology note

For the methodology, disposition data, cost model, and limitations, read more here. Dated leaderboard screenshots and a disposition data appendix are available in the document. HackerOne is a trademark of HackerOne Inc. HackerOne has not sponsored, verified, approved, or endorsed this release. HackerOne rankings are dynamic and recalculated daily.

About FireCompass

FireCompass is an agentic AI platform for autonomous penetration testing and red teaming across web, API, and infrastructure. It discovers shadow assets, multi-stage attack paths, credential reuse, business-logic flaws, and lateral movement with near-zero false positives. FireCompass is trusted by Fortune 1000 organizations and recognized in 30+ analyst reports. More at firecompass.com.

Media contacts
Priyanka Aash
FireCompass Technologies Inc.
+1 650-248-4625
[email protected]

SOURCE FireCompass Technologies Inc.