Image: OpenHack
Why it mattersTeams running CodeQL, Semgrep or Snyk have a Fall 2026 YC startup claiming to beat them on OWASP. Try it on your own code before trusting the claim.
An application security tool that only finds pattern-match bugs misses the ones a real attacker chains together. OpenHack, a Fall 2026 Y Combinator company, launched today with an AI scanner it says catches those logic bugs. The launch page listed 9 votes at the time of writing. The founder, Ananay Arora, named four vulnerabilities OpenHack found in customer codebases.
What OpenHack claims to do
OpenHack's launch post describes the tool as an "always-on AI security engineer". OpenHack says the tool learns the codebase, the infrastructure and the business logic. It then scans the code for logic bugs and alerts the team only about ones it has verified as real.
The product covers AI code scanning and AI pentests of a running app. It also scans supply chain and secrets. It integrates with Linear and Slack. It exposes an MCP endpoint so a coding agent can trigger scans and apply fixes. The launch offer is free scans on Claude Mythos until 11 November 2026.
The four vulnerabilities
The post names four bugs OpenHack found in customer codebases. The first was a full account takeover. The tool retrieved every user's sensitive data and logged in as any user. The second was a GitHub organisation takeover. The tool chained bugs to get admin access, including the right to delete the organisation. The third was a payment and billing bypass. Business logic flaws unlocked paid features for free. The fourth was unauthorised access to Papermark's S3 buckets. Papermark is a document-sharing platform. The launch post says it is used by Fortune 500 companies. The advisory is public at openhack.com/advisories/OH-2026-001.
Arora writes that none of these bugs were caught by code review or by what the post calls "traditional scanners".
The benchmark claim and its limit
OpenHack says it "outperformed Github CodeQL, Semgrep and Snyk on the OWASP benchmark". The post gives no scores, no test set version and no methodology.
OWASP benchmark is a public test suite. The three named tools are the ones most companies already run in their build pipelines. The claim is OpenHack's own and has no third-party audit behind it. A buyer should run OpenHack and the current tool on the same code before trusting the comparison. OpenHack also says it is building a second benchmark, PentestBench, for logic bugs that need a full exploit chain. That one does not exist in a form a buyer can read yet.
Who built it
Arora writes on the launch page that he has 12 years of vulnerability research. His bug bounties list Meta, Apple, Perplexity, DHS and Y Combinator. The post names seven customers trusted with the tool: Pocket, HydraDB, Docura Health, OpenSEO, Hue, Melty and Papermark. The company is at openhack.com.
Source
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
