· 6 min read
XBOW made autonomous AI pentesting famous by topping a public bug-bounty leaderboard. It is also closed, cloud-hosted and priced for enterprises. If you want the same idea but open source, self-hosted and local, here is the honest path.
Why teams look past XBOW
- Data sovereignty. XBOW is a vendor cloud; your targets and traffic transit it. Darkmoon runs on your infrastructure and can use a local LLM, so nothing leaves.
- Auditability. XBOW is a black box. Darkmoon is GPL-3.0, read and modify the methodology.
- Cost. No enterprise contract; clone and run.
Does open source actually find things?
Yes, measurably: Darkmoon found 57 real vulnerabilities on OWASP Juice Shop in 28 minutes, black-box, local model, exploit-proven per finding, published and reproducible in the open AI-pentester benchmark. The point is not to claim a number nobody can check; it is to publish one anyone can.
Full disclosure: Darkmoon is our project. github.com/ASCIT31/Dark-Moon.