FireCompass AI agent reaches HackerOne Top 3, showing how cheap offensive AI has become

FireCompass, an agentic AI platform for autonomous penetration testing and red teaming, announced that its AI-powered penetration testing agent secured Top 3 positions across multiple HackerOne global leaderboards during a three-month live bug bounty experiment.

According to CXOToday, the experiment ran against authorized live production systems rather than controlled lab environments. FireCompass's autonomous agents independently discovered, validated and responsibly reported vulnerabilities while operating at a cost comparable to a single manual application penetration test.

Founder and CEO Bikash Barai said the agents had already reached 100% on internal benchmarks, and this experiment tested what it costs to reach the top of a global bug bounty leaderboard — about $5,000 per month. This means threat actors with a very small investment can be as powerful as the world's top hackers.

The exercise combined multiple frontier models with FireCompass's purpose-built small language models, paired with safety controls: hard enforcement of each program's authorized scope, non-destructive validation of vulnerabilities, and limits on request rates, concurrency and blast radius.

Security technologist Bruce Schneier, a FireCompass advisor, said the history of security is a history of falling costs. "This experiment shows offensive AI has crossed that line," he said, adding that the question now is whether defenders adopt the same capability fast enough.

Jay Bavisi, founder and CEO of EC-Council, which invested in FireCompass, said the future of offensive security testing is not AI replacing cybersecurity professionals but AI-powered professionals.

For enterprises, the results suggest penetration testing is shifting from periodic manual engagements toward continuous, affordable AI-driven validation — and that governance, scope enforcement and human accountability will matter as much as model capability.