A security finding lands in the queue. Someone needs to work out whether it is real, whether an attacker can reach it and what to fix first. [1][3]
More alerts do not answer those questions. Engineers still need to investigate the application and reproduce the problem. [3]
OpenHack is building an always-on AI security engineer for that work.
It scans code, runs penetration tests, verifies vulnerabilities and prepares fix pull requests. Application and business information help determine which findings need attention first. [1]
The output is a finding an engineer can investigate and a proposed fix to review. [1][3]
Find, verify, prioritize and fix
OpenHack reads code in the context of the application. It looks across authentication, APIs, dependencies, secrets and business logic. Pull-request reviews bring that work into development. [1]
Its penetration-testing agents check application behavior. Verification reproduces a suspected issue in a sandbox or browser before the vulnerability is reported. [1]
Prioritization considers exposure, reachability and the affected business process. That can put an exploitable production issue ahead of a less consequential alert. [1][3]
The assistant also works in Slack and Linear. A team can ask about a finding or assign remediation work, then review the resulting pull request. [1]
Built by a security researcher
Ananay Arora has spent more than a decade researching security. Arora’s work includes bug bounties from companies and organizations such as Apple, Meta and Y Combinator. [2][3]
OpenHack started around three related problems: false positives, testing that falls behind changing applications, and backlogs that do not explain priorities. [3]
Founded in 2025, the company joined Y Combinator’s Fall 2026 batch. It serves engineering and security teams working on application security. [2]
Papermark: following a finding through to application behavior
OpenHack found an authentication bypass in Papermark’s upload endpoint. An asynchronous session check was missing an await, so the code tested a promise instead of the completed session result. [4]
The agent followed that behavior through the upload service and verified an unauthenticated upload. That turned a suspicious line into a reproducible vulnerability. [4]
OpenHack reported the issue to Papermark on March 1, 2026. The fix was merged the following day. The research was published as CVE-2026-36755. [4]
The example captures OpenHack’s approach: understand the application, test the suspected weakness and give the engineering team a finding it can reproduce. [4]
An open harness and a managed platform
Teams can run the open-source CLI locally and choose their own AI model provider. The managed platform adds continuous scanning across repositories, team controls and automated fix pull requests. [1]
Here’s how a development team would use the platform: review a verified finding, ask the assistant about its impact and route the proposed fix through normal code review. [1]
The company is developing these capabilities together as a security engineer that follows work from investigation through remediation. [3]
Where OpenHack ranks
Current rankings. Positions come from public evidence, and no company can pay for a place. How we rank
The bigger picture
An engineering team needs to know which security problem matters and what to do about it. [3]
OpenHack brings investigation, behavioral verification and a proposed fix into the same process. [1][3]
An always-on security engineer, with work ready for the team to review.
Written by SOTA2 from OpenHack’s public materials. Customer experiences and product plans are reported by OpenHack. Ranking analysis and comparison data are from SOTA2.