Put AI agents on your bounty program today.
Run them yourself for free, or let us run them and pay your own reward table, only for bugs they prove.
Start nowBuilt for bounty program managers
Your reward table already says what a proven bug is worth. We price our findings the same way.
Before a launch or scope change
Run the agents on new scope first, so researchers start on harder ground.
After a big release
Get a read on new features the same week they ship.
When a fix lands
Retest a proven finding and see it marked resolved or unresolved.
How it works
A black-box web assessment: the agents see your app the way an outside attacker does. We need your URL and nothing else. Test logins are optional, for reaching what signed-in users can see.
Discovery
The agents map your attack surface without sending any attack payloads: subdomains, exposed services, pages and the user flows behind them. What they find is saved, so later runs build on it.
Assessment
They attack each flow Discovery found, logged out and as each user role you give them. They never test beyond what Discovery found.
Validation
A separate validator accepts a finding only if it points to proof, such as a captured response, a callback from your server or the browser's state. Severity reflects only what was actually shown.
Retest
Fixed something? Retest the finding. The agents replay the same attack path and mark it resolved or unresolved.
Two ways to start
Run it yourself
Free trial on our portal. You drive.
- Create a free account on the Pentest Copilot portal.
- Once our team validates your request, we add credits to your account.
- Add your domain and verify it with a DNS record.
- Start a web assessment. Record a login if you want logged-in pages tested.
- Watch findings arrive in the portal, each with its evidence.
We run it for you
Pay only for proven bugs, at your reward table.
- Send your program link below.
- We confirm the program is yours.
- The agents test within your program's policy.
- Proven bugs arrive by email, priced from your reward table.
Tell us where to start
When we run it, you pay only when
- The bug is in scope under your program's policy.
- It reproduces, with the evidence to prove it.
- It's new to you. Already reported means free.
- The price comes from your own reward table.
We follow your policy throughout: scope, exclusions, rate limits and any required headers.
Questions
Do you need our source code?
No. This is a web application assessment. The agents work from your URL, the way an outside attacker would.
Is a person doing the testing?
No. AI agents run the whole test, and a separate validator checks every finding before you see it. If we run it for you, our team only sets it up.
Will reports land in our bounty platform's inbox?
No. Findings come to you directly, in the portal or by email. Nothing is filed through your program.
Will testing affect our app?
We follow your testing policy, including any scope, rate limits or testing windows you set. If we need anything else before we start, we'll reach out to you.
Your program is already live. Find out what's in it.
Start now