Bountyforge

BountyForge is an autonomous penetration testing engine that runs AI agents against a web target to find and prove security vulnerabilities for bug bounty and security research work. Each audit gets its own isolated Firecracker microVM, destroyed when the session expires, and the platform moves every target through reconnaissance, hunting, verification and reporting, keeping state so later hunts build on earlier ones. It is aimed at bug bounty hunters and security researchers who want findings that survive triage rather than raw scanner output. Reconnaissance draws on 90 security tools arranged in dependency ordered waves, then 22 hunting agents spawn per vulnerability class, including XSS, SSRF, SQL injection, IDOR and authentication bypass, executing real commands and coordinating through a shared case file. Nine validation gates, including differential probes, proof of concept replay and a second LLM opinion, confirm a lead or demote it. Reports are formatted for HackerOne with CVSS scores, CWE classification, proof of concept files and remediation. The AI runs on a local Ollama fleet by default, with DeepSeek cloud models on paid plans, and memory of each target type persists across hunts. Pricing is published. Pro is $30 per month with 9 scans and 9 sandbox sessions, a three hour session limit and email support. Enterprise is $90 per month with 30 scans and 30 sessions, custom session limits and priority support. Extra scans cost $7 each. A Custom tier with dedicated infrastructure, on premise deployment and white label options is quote based, and a self hosted license is available. A Founding offer of $199 once gives lifetime Pro access with 12 scans a month for the first 70 buyers, refundable any time before launch, which suggests the platform is still in its early access phase.