Aiolum Browse stories
All stories
AI agents that find, prove and fix exploitable security bugs in code · United States

Hacktron AI: Revenue, team and how it was built

Small teamFundedB2BCybersecurity

Hacktron AI (AI agents that find, prove and fix exploitable security bugs in code, United States): About US$240K revenue in its first nine months, May 2026. Evidence grade D: reported, not verified. Team: 3 founders at the start in mid-2025; the team page names 4 people and the site has 9 team profile pages in November 2026, after a US$2.9M pre-seed round in May 2026. Launched 14 August 2025; still running.Added 6 November 2026

Outcome
About US$240K revenue in its first nine months, May 2026
Evidence
D reported, not verified
Launch
14 August 2025
Status
Still running
Team
3 founders at the start in mid-2025; the team page names 4 people and the site has 9 team profile pages in November 2026, after a US$2.9M pre-seed round in May 2026
Outside funding
US$2.9M pre-seed, May 2026, led by Crane Venture Partners
Main channel
Not stated
Reported, not verified

What is not verified

The revenue figure of approximately US$240,000 in the first nine months rests on one source: a news release by Cambridge Enterprise, which invested in the round, dated 15 May 2026. The company's own pages give no revenue figure, and an article on devops.com about the round could not be opened (403). A reader could look for a second interview with the founders, a later funding announcement with figures, or a company filing. The exact headcount is also not published. The headline number is grade D: one claim or one estimate, with no second source. Aiolum shows it because the story is useful, and marks it so that it is not mistaken for a verified figure.

Hacktron AI sells offensive security software, which means testing a system the way an attacker would, to find holes before a real attacker does. Its agents read a customer's source code, build a call graph (a map of which function calls which), follow untrusted input through it and try to prove each finding with a working exploit in an isolated sandbox. The products are Review for every pull request (a proposed code change waiting for approval), Whitebox for a full penetration test (an authorised simulated attack, usually done by hand by consultants) and Red for continuous testing of a whole organisation.

Zayne Zhang, Mohan Pedhapati and Harsh Jaiswal started the company in mid-2025 and published their launch post on 14 August 2025. Cambridge Enterprise, an investor in the company, wrote on 15 May 2026 that Hacktron had generated approximately US$240,000 in revenue in its first nine months, in the announcement of a US$2.9 million pre-seed round led by Crane Venture Partners. In April 2026 it took second place at the Vercel AI Accelerator Demo Day.

The revenue figure appears in one source only, an investor's press release, so it is grade D. No payment processor, filing or second interview confirms it. This page also shows earlier security and code-analysis startups that failed in a crowded market.

Hacktron AI: About US$240K revenue in its first nine months, May 2026. AI agents that find, prove and fix exploitable security bugs in code, United States, team of 2 to 10, evidence grade D.
The story in one card. Share it with the address of this page.
01

How much revenue does Hacktron AI make?

Each row shows the evidence grade and the source numbers from the list at the end of this page. The grades are explained in How Aiolum verifies.

A security company started by three hackers in 2025, with about US$240,000 of revenue in nine months as stated by an investor, and no second source for the figure
FactValueGradeHow we knowSources
Revenue in the first nine months, to May 2026approximately US$240,000DCambridge Enterprise news release, 15 May 2026: "Hacktron has already generated approximately $240,000 in revenue in its first nine months". Cambridge Enterprise Ventures took part in the round, so this is an investor's statement. No second source found.[1]
Average revenue per month in that periodabout US$26,700calcCalculated: US$240,000 divided by 9 months.[1]
FundingUS$2.9 million pre-seedCCambridge Enterprise, 15 May 2026. Led by Crane Venture Partners, with Project Europe, Vercel Ventures, Plug and Play Ventures and Cambridge Enterprise Ventures. The founder's Osome interview speaks of three million dollars in funding.[1, 6]
FoundersZayne Zhang (CEO), Mohan Pedhapati (CTO), Harsh Jaiswal (Chief Research Officer)CTeam page and Cambridge Enterprise release. Vercel's accelerator recap names the same three founders.[3, 1, 5]
Team in November 20264 people named on the team page; 9 team profile pages in the sitemapCThe about page calls Hacktron "a small team of hackers". The careers page lists three open roles. No source gives an exact headcount.[3, 9]
Start of the companymid-2025CFounder interview with Osome: "Zayne and his co-founders started the company in mid-2025". The first scan shown in the launch post is dated 5 May 2025.[6, 4]
Public launch14 August 2025CLaunch post "Introducing Hacktron", with a public pentest report of Gumroad: 12 issues, one of them a critical SQL injection.[4]
Model named at launchGemini 2.5 ProCLaunch post: the swarm of specialised agents ran on Gemini 2.5 Pro. Later research posts name Anthropic's Claude Opus models.[4, 8]
Vercel AI Acceleratorsecond place at Demo Day, 16 April 2026BVercel's recap: 39 teams pitched after six weeks; "2nd: Hacktron AI".[5]
OpenAI bug bountyUS$6,500, for bugs found on 23 to 25 July 2026CCompany blog: two chained vulnerabilities gave access to OpenAI employees' ChatGPT and Codex accounts; OpenAI fixed it about 14 hours after the report and paid a bounty.[8]
Time from launch to the revenue figure9 monthscalcCalculated: August 2025 to May 2026.[4, 1]

How to read this table: grade D means one source states the figure and nobody else confirms it. Grade C values come from the company's own pages or the founder's interview. Grade B values come from a journalist or another independent party. A value marked X was computed on this page.

Hacktron prices from the pricing section of its home page, read 6 November 2026 (grade C)
PlanPer month, billed yearly (US$)Per month, billed monthly (US$)Limit
Review Profrom 40 per developer50 PRs per developer, US$1 per extra PR
Review Enterprisecustomrules per repository, SSO, audit logs
Whitebox pentest50 to 25,000 per pentestabout US$500 per 100,000 lines of code
Whitebox Enterprisecustomon-premises deployment
Redcustomcontinuous red teaming

Review Pro is priced per developer per month and includes 50 pull requests per developer, with US$1 for each extra pull request; the page says it is free for open-source projects and offers a 14-day trial. Whitebox is priced per pentest by code size, about US$500 per 100,000 lines of code according to the page. Red and the Enterprise plans have no published price. The page does not show a yearly discount.

02

When did Hacktron AI launch, and how did it grow?

From a first AI-run audit in May 2025 to a funded team that publishes zero-day research, in about 18 months. Each entry carries its grade.

  1. 5 May 2025CFirst audit: Hacktron's agents scan the open-source Gumroad code and find 12 issues. [4]
  2. Mid-2025CThe three founders, who met in Capture The Flag hacking contests, start the company as a remote team with a US company and a Singapore entity. [6]
  3. 14 August 2025CLaunch post and public Gumroad pentest report. [4]
  4. 16 April 2026BSecond place at the Vercel AI Accelerator Demo Day. [5]
  5. 15 May 2026DUS$2.9 million pre-seed round. The investor Cambridge Enterprise states about US$240,000 of revenue in the first nine months. [1]
  6. 25 July 2026CHacktron chains two bugs into OpenAI employee accounts, reports them and later receives a US$6,500 bounty. It publishes the account in September 2026. [8, 9]
  7. September 2026BSome security professionals criticise the team for opening a harmless pull request in OpenAI's internal code to prove access. [7]
03

Why did Hacktron AI work?

Four causes, in the order they mattered. Each one is a reusable lesson.

01

Expertise

The founders sold what they had done by hand as consultants: finding bugs that can really be exploited. Their agents encode that method, and human researchers check findings in the Whitebox pentests, according to the FAQ.

02

Proof instead of alerts

Most scanners report patterns that might be wrong. Hacktron tries to prove each finding with an exploit and reports only those, so a security team spends less time on false alarms. The customer quotes on the home page all say this.

03

Public research as marketing

The company publishes zero-day findings in well-known software. The media page lists dozens of press articles from 2026, and the investor release says a team member has nearly one million YouTube subscribers.

04

Prices that fit self-serve buyers

The home page lists Review from US$40 per developer a month and pentests priced by lines of code, so a small company can start without a sales call, while larger customers get custom plans.

How it was built

These details come from the company's own pages and the founder's interview. They are grade C. [4, 10, 6]

  • A swarm of specialised agents, some purely model-based, some based on the syntax tree of the code, each focused on one class of weakness. At launch they ran on Gemini 2.5 Pro.
  • Hybrid static and dynamic analysis: the agents read the code, map the attack surface and test findings in an isolated sandbox, or against the deployed app when dynamic testing is on.
  • Review connects to GitHub, GitLab, Azure DevOps and Bitbucket, posts comments on the affected lines and can open fix pull requests. A public REST API and an MCP server start scans.
  • Customers can add a .hacktron/rules.md file to describe their stack, and triage replies in the pull request teach the agent.
  • The US company was set up with Stripe Atlas and the Singapore entity with Osome, according to the founder.

Tools named in the sources

Each one opens its page in the Tools tab, with every story that uses it.

04

Who tried this before Hacktron AI, and why did they fail?

Four companies in our database of failed startups tried to sell code analysis or security tools and failed against larger platforms and free tools. The values below are from that database and are not independently verified.

Died 2012 to 2024Burned US$7M

Sider

The promise

Automated code review and static analysis for development teams, to catch bugs and security flaws in CI pipelines.

Why it died

Squeezed between free open-source tools and large platforms that bundled code analysis into their security suites.

Competition
Died 2015 to 2018Burned US$4.5M

ThinAir

The promise

Real-time prevention of data breaches.

Why it died

Could not stand out in a crowded security market; false positives and large competitors.

Competition
Died 2016 to 2019Burned US$120K

Metapacket

The promise

Cloud-based network packet analysis for threat detection without hardware.

Why it died

A niche product in a market where buyers chose broad security platforms.

Competition
Died 2011 to 2018Burned US$3M

Toopher

The promise

Two-factor login that used the phone's location to remove friction.

Why it died

Acquired by Salesforce in 2015 and later discontinued; competitors offered broader security.

Competition

The failed startups come from our database of 1,749 dead startups, retold here in our own words. Its entries are AI-assisted summaries of public sources, so these cards carry no evidence grade.

What changed

The predecessors sold detection: rules and models that flagged what might be wrong, and buyers drowned in alerts or chose a big platform. Sider is the closest case, an automated code review service that lost to free tools and bundled suites.

Two things differ for Hacktron. Large language models can now reason about how data flows through code and write a working exploit, so a tool can report only proven bugs. And the founders' own public findings, with press coverage, give a small team the trust that security buyers usually give only to known brands. Whether that holds against large security vendors that add the same models is still open.

05

Can one person copy Hacktron AI now?

Hard to copy without the same skills.

The method is clear, but it rests on three people with years of professional penetration testing and contest wins, and on research that gets press coverage. A solo founder today could copy the narrow part: one class of bug, for one framework, sold per pull request.

Where it is still open: Security review for one framework or platform (for example apps built with AI app builders), checks for prompt injection in AI features, and audit reports for small companies that need SOC 2.

  1. 1Pick a security task you already do by hand as a consultant, and encode your own method in agents.
  2. 2Report only findings the agent can prove, with the exploit and a fix.
  3. 3Publish real findings in known software, with coordinated disclosure, as your marketing.
  4. 4Offer a self-serve price per developer or per line of code, next to custom contracts.

What could go wrong for Hacktron AI?

The risks are the mirror image of the causes above.

What is not verified

The revenue figure of approximately US$240,000 in the first nine months rests on one source: a news release by Cambridge Enterprise, which invested in the round, dated 15 May 2026. The company's own pages give no revenue figure, and an article on devops.com about the round could not be opened (403). A reader could look for a second interview with the founders, a later funding announcement with figures, or a company filing. The exact headcount is also not published.

The OpenAI disclosure was debated

Hacktron reported its OpenAI bugs and OpenAI paid a US$6,500 bounty, according to the company's blog. The Stack wrote in September 2026 that some security professionals objected to the team using an employee's Codex access to open a harmless pull request in OpenAI's internal code, while others said it had to prove the access.

Part of the work is a service

The FAQ says that in a Whitebox pentest, security researchers validate the findings and deliver reports and a retest, and Red is sold only by custom contract. The Review product is self-serve software with a published price.

Competition

Hacktron's own blog compares it with Snyk, Semgrep, Aikido, CodeRabbit, Greptile and XBOW, all larger or funded competitors. On this site the nearest stories are PromptGuard and Kyvvu, which secure AI systems rather than application code, and both are grade E.

Dependence on model providers

The launch post says the agents ran on Google's Gemini 2.5 Pro, and later research posts describe exploits built with Anthropic's Claude Opus models. A change in price, access rules or abuse filters at these providers could affect a product that writes working exploits.

Unchecked customer quotes

The home page shows six customer quotes with names and job titles but without company names next to them; the site map has customer pages for Krisp, Mobbin, Rocket.Chat and others. These were not checked with the customers.

Sources

The grade next to each source is the best grade that the source can support. "Read in full" means that the text of the page was downloaded and the numbers were checked in it.

  1. D Cambridge Enterprise, 15 May 2026: Hacktron raises $2.9M pre-seed to bring AI-powered security testing to every code change
    Read in full. An investor's news release. Source for the revenue figure, the round, the investors and the founders.
  2. C Hacktron home page, read 6 November 2026
    Read in full. Source for the products, the prices and the customer quotes.
  3. C Hacktron about and team pages, read 6 November 2026
    Read in full, with https://www.hacktron.ai/team. Source for the team, the roles and the dated photos.
  4. C Hacktron blog, 14 August 2025: Introducing Hacktron
    Read in full. Launch post. Source for the first audit date, the Gumroad findings and the model used.
  5. B Vercel blog, April 2026: 2026 Vercel AI Accelerator recap
    Read the section on the winners. Source for the second place and the founders' names.
  6. C Osome customer story: From Pentester to Founder: Hacktron's Singapore Story with Osome
    Read in full. Founder interview. Source for the start date, the remote team, the funding mention and the incorporation services.
  7. B The Stack, September 2026: Did Hacktron's OpenAI probe go too far?
    Read in full. Source for the criticism of the OpenAI disclosure.
  8. C Hacktron blog, September 2026: Hacking OpenAI
    Read the timeline and disclosure sections. Source for the dates, the bounty and the models used.
  9. C Hacktron media page and sitemap, read 6 November 2026
    Read in full, with https://www.hacktron.ai/sitemap-0.xml. Source for the dated press list and the count of team profile pages.
  10. C Hacktron FAQ, read 6 November 2026
    Read in full. Source for how the products work, the integrations and the human validation in Whitebox.
  11. C Database of failed startups, local export
    Local export. AI-written summaries, not independently verified. Source for the failed predecessors.

Run this company? Send corrections or a verified figure to aiolum@livyden.com

Back to all stories