Penetration Testing,
Powered by AI Agents
BugBunny deploys coordinated AI agents to perform reconnaissance, vulnerability discovery, proof-of-concept validation, and automated patch suggestions — continuously and at scale.
Autonomous testing begins immediately after you provide an authorized target
See It In Action
Watch BugBunny Work
From target submission to validated findings — watch a complete autonomous security audit in under two minutes.
Capabilities
Enterprise-Grade Security Automation
Coordinated AI agents that adapt, persist, and validate — just like a real red team.
Automated Reconnaissance
Coordinated AI agents systematically map your attack surface — discovering subdomains, endpoints, and exposed services across your entire infrastructure.
Adaptive Vulnerability Testing
Context-aware testing agents that adapt their methodology to each target, from black-box web application testing to white-box source code analysis.
PoC Validation
Every finding is validated with a working proof-of-concept exploit, eliminating false positives and delivering audit-ready reports with CVSS ratings.
PR Review & Patch Suggestions
BugBunny reviews each Pull Request, identifies exploitable vulnerabilities in the diff, and suggests inline patches — turning every PR into a security gate.
0+
High/Critical CVEs
0.8
Peak CVSS Score
0M+
Downloads At Risk
24/7
Continuous Testing
Track Record
Wall of Fame
BugBunny.ai has identified critical security vulnerabilities in production systems, resulting in official CVE assignments and responsible disclosures — the same detection capabilities available in your audits.
Vulnerabilities identified in production systems from leading technology companies
CVE-2026-27471
ERPNext Unauthorized Document Access via Missing Validation
BugBunny.ai discovered a critical access control vulnerability in ERPNext, a widely-used open source ERP system. Certain endpoints lacked access validation, allowing unauthorized users to access sensitive business documents including employee records, financial data, and invoices without any authentication.
CVE-2026-22807
vLLM auto_map RCE via Untrusted Dynamic Module Loading
BugBunny.ai discovered a high severity remote code execution vulnerability in vLLM where Hugging Face auto_map dynamic modules are loaded during model resolution without gating on trust_remote_code. This allows arbitrary Python code execution when loading models from untrusted sources.
CVE-2026-21884
React Router SSR XSS in ScrollRestoration
BugBunny.ai discovered a cross-site scripting vulnerability in React Router's ScrollRestoration API during Server-Side Rendering. Unescaped JSON in inline scripts allows arbitrary JavaScript execution when user-controlled data is used in getKey or storageKey props.
CVE-2025-61622
Python RCE via Unguarded Pickle Fallback in pyfory/pyfury
BugBunny.ai identified a critical deserialization issue in Apache Fory's Python modules (pyfory/pyfury) where unsupported object types fall back to Python's unsafe pickle loader. Crafted data streams from untrusted sources force the pickle fallback, enabling arbitrary code execution across affected versions (0.1.0–0.10.3 and 0.12.0–0.12.2).
CVE-2025-58434
Account Takeover (Local & Cloud) - Token Leak
BugBunny.ai discovered a critical vulnerability in flowise.ai that allows complete account takeover through token leakage affecting both local and cloud deployments. This vulnerability enables unauthorized access to user accounts and sensitive data through exposed authentication tokens.
CVE-2025-59057
Stored XSS Vulnerability in React Router
React Router, a widely used routing library in the React ecosystem, is affected by a stored cross-site scripting (XSS) issue under specific input handling conditions. This may allow persistent script execution impacting application users.
CVE-2025-61686
Path Traversal in React Router File Session Storage
BugBunny.ai uncovered a path traversal issue in React Router's file session storage adapter. Crafted session IDs could escape the intended directory and overwrite arbitrary files on the host, impacting any deployment persisting sessions to disk. The maintainers shipped a fix and coordinated disclosure via GitHub Security Advisories.
Latest Discovery: CVE-2026-27471 – ERPNext Unauthorized Document Access via Missing Validation
All vulnerabilities are discovered through automated AI-powered security testing and reported through responsible disclosure
Workflow
How It Works
Three steps from target definition to validated, audit-ready security findings.
Define Your Target
Provide an authorized domain, IP range, or connect a GitHub repository. BugBunny validates the scope and begins immediately.
Autonomous Agent Deployment
Specialized AI agents work in parallel — reconnaissance, vulnerability scanning, exploit development, and validation run simultaneously.
Validated Findings & Reports
Receive audit-ready reports with verified proof-of-concept exploits, CVSS severity ratings, and step-by-step remediation guidance.
Pricing
Security Plans for Every Team
Scalable coverage from team-level testing to enterprise-wide security programs. Every plan includes validated findings with proof-of-concept exploits.
> RECON
Best for startups & dev teams securing their first apps
Continuous automated pentesting for your attack surface
Replaces a $4,000+ manual pentest — every month
- 25 domain audits per month
- 50 credits for AI follow-ups
- Full-depth OWASP Top 10 + beyond scanning
- Verified PoC exploits with CVSS scoring
- Custom scan directives & depth control
- GitHub repository integration
- Compliance-ready PDF audit reports
- Email alerts on critical findings
- Priority support
- Chrome extension access
> STRIKE
Best for security teams & high-growth engineering orgs
Maximum-depth coverage with the highest detection rate
Replaces $20,000+/yr in manual pentesting engagements
Everything in Recon, plus:
- 150 domain audits per month
- 500 credits for AI follow-ups
- Maximum scan depth & attack surface coverage
- Highest vulnerability detection rate
- PR review with inline patch suggestions
- API access
- Dedicated account manager
> COMMAND // MILITARY GRADE
Best for enterprises needing unlimited scale & custom SLAs
Military-grade vulnerability detection at scale
White-glove security program — replaces entire pentest teams
Contact Sales →Everything in Strike, plus:
- Unlimited domain audits
- Unlimited AI credits
- Military-grade detection depth
- Zero-day class vulnerability research
- PR review with inline patch suggestions
- SSO / SAML authentication
- Guaranteed SLAs & uptime
- On-premises deployment option
- RBAC & team management
- Jira, Slack & SIEM integrations
- Dedicated support & onboarding
Secure payments via Stripe · All prices in USD · Plans renew monthly · Zero Day / Zero Pay guarantee on all plans
Get Started
Ready to Strengthen Your Security Posture?
Deploy autonomous AI agents that continuously test your infrastructure, validate vulnerabilities with working exploits, and deliver audit-ready findings.
Launch Audit ConsolePlans starting at $499/month · Enterprise plans available · Only test authorized targets