Introducing Hacktron AI: An autonomous penetration test of Gumroad

TL;DR

Gumroad was the very first audit we conducted at Hacktron a few months ago, and the results blew us away.

We ran our swarm of specialized agents using Gemini 2.5 Pro. Some were purely LLM-based, some AST-based, and others purpose-built for niche vulnerability classes. Our cutting-edge source code review agents were each laser-focused on a different weakness.

We’re proud to publicly release the pentest report, which you can view below. This is a first-of-its-kind demonstration of AI-powered penetration testing delivering equivalent results to a human pentest team.

Intro

At Hacktron, we’re building collaborative AI agents that act as autonomous security researchers¹, capable of working across the entire software development lifecycle to find, triage, and fix vulnerabilities automatically.

These agents think like human hackers, collaborate across tasks, and take real action. This is made possible by distilling the expertise of our world-class security research team into our agents.

Further, we’re also building standardized security benchmarks to evaluate AI capabilities, and backing it all with zero-day research.

Manifesto

As security researchers, we live for zero-days³ and novel exploits. But the vast majority of real findings are not intellectually challenging research problems that take years to materialize. They are repetitions of the same mistakes in different places. These are the vulnerabilities that constitute more than 90% of the software security problems we face today, showing up across OWASP Top 10, HackerOne Bugcrowd, Synack, Cobalt yearly reports. Pentests and Audits only find variants of already existing vulnerabilities. We don’t want to patch one hole only for another one to show up months later. The only way to do this is to flip the penetration testing model on its head.

Just as AI has enabled an entire generation of non-technical users to build software, we see a real opportunity to bring the expertise of security researchers to ambitious teams who don’t have the time or expertise to think deeply about security. The fundamental difference here is that AI allows us to do this at scale and with much higher continuity compared to traditional security audits.

We are not just another static code analyser or security scanner. We are building a full-stack security engineer. This means going through the entire process of finding, triaging, and patching vulnerabilities autonomously.

These principles guide everything we build.

• PoC || GTFO: Most security scanners are just noise. We find and confirm vulnerabilities that are actually exploitable, and we do this by working across the entire software development lifecycle.

• Fostering open-source security: Our long-term goal is to secure the backbone of the internet — Chromium, Linux, Apache, and everything that keeps the world online.

• Continuous evaluation of AI capabilities: We believe capable AI agents pose both an opportunity and a threat. That’s why we commit to open, continuous evaluation through real-world benchmarks — for the benefit of builders, policymakers, and the wider technology community. We’ve laid out our approach in detail at Hackbench.ai

The Gumroad Pentest

Saying “PoC || GTFO” then dropping a vague launch post with no real outcomes would’ve been just more noise. So instead, we’re presenting our work — an AI-powered pentest on a real product, with real findings. We pointed Hacktron at Gumroad, and it delivered.

This was part of a broader wave of assessments we’ve been running — targeting open source products, bug bounty targets, and enterprise software.

Among the various systems hacked by our agents, the Gumroad team demonstrated exceptional responsiveness. From initial disclosure to triage and resolution, their handling of issues was fast and effective. We would like to thank Sahil and Ershad for their colloboration throughout the process. We are now collaborating with Antiwork to integrate Hacktron into their CI/CD pipeline for ongoing, autonomous security monitoring.

How Hacktron Works

To initiate the engagement, we connected Hacktron to the Gumroad codebase and triggered a full-scope assessment.

Hacktron began by cloning the repository and analyzing the application’s architecture. It performed a hybrid of static and dynamic analysis — reasoning through frontend and backend flows, mapping attack surfaces, and identifying critical data flows and control points.

For Gumroad, when vulnerabilities were identified, Hacktron triaged them autonomously, prioritizing issues based on exploitability, reachability, and security impact.

Each issue included full technical context: source traces, affected files, and remediation strategies. These were surfaced through a dedicated dashboard for both our team and Gumroad’s engineers. Raw tickets can be found on Hacktron’s hacktivity.

Our human researchers then reviewed and validated Hacktron’s findings, producing production-ready PoCs. In its latest version, Hacktron now integrates PoC generation and automated triaging, streamlining the process even further.

Reporting

For anyone in the security industry, these findings speak for themselves. These weren’t theoretical bugs or generic checklist items. They were exploitable, high-impact vulnerabilities. The SQL injection alone posed a serious risk, and Gumroad moved quickly to remediate it. A traditional pentest for the same scope would cost between $20,000 and $30,000, we achieved it for roughly one-third of the price.

Patching

For confirmed issues, Hacktron generated suggested code-level patches and submitted Pull Requests, which were then merged by the Gumroad team.

About Us

Our security research team is world-class: top-ranked CTF competitors, DEF CON-published researchers, acclaimed creators, and leading bug bounty hunters. We’ve hacked everything from browsers and operating systems to mobile apps, desktop software, and massive web platforms.

Chances are, you’ve used something we’ve helped make more secure.

We’re now channeling that expertise into Hacktron: AI agents that bring real offensive capability into every stage of the software lifecycle.

Meet our team at https://www.hacktron.ai/#team.