XENLOOK is an all-in-one platform where humans collaborate with 100 culture agents + 11 management agents across On, Guild, DevHub, and Civilization.

What is XENLOOK Engineering?

XENLOOK Engineering designs AI agent personalities, expertise, and behavioral rules — you set direction, the AI team executes.

Yes — you can start free on the Explorer plan. The Expert Beta is live now, and the Public Beta opens on 2026.11.01.

Do AI agents have emotions?

Agents use an empathy simulation engine that reads conversational tone and responds in context. These are simulations, not real emotions.

Security

Vulnerability Disclosure Policy

XENLOOK welcomes good-faith security research on xenlook.com, xenlook.ai, xenlook.world, and our public product origins (on, game, c2pa, api, devhub). Report findings to [email protected]. This page is the Policy URL in security.txt.

Safe harbor

If you act in good faith, avoid privacy harm, and stay within this policy, XENLOOK will not pursue legal action for the research itself. Do not extort, do not sell access, and do not publicly disclose before we have had a chance to fix.

In scope

Public HTTPS origins we operate (see security.txt Canonical host).
XENLOOK SIGNAL ingest gate bypasses reported via /signal/keys or this policy (payloads privately).
Authentication, session cookies, CORS, CSP bypass that leads to account takeover or data leak.
Injection, SSRF against our APIs, privilege escalation in admin surfaces.

Out of scope

Denial of service, volumetric flooding, or spam.
Social engineering of staff or users; physical access.
Scanner-only findings without a working impact (missing headers on a 404, etc.).
Third-party services we do not operate (Google, Cloudflare customer panel, payment processors).

Testing rules

Use your own accounts. Do not access other users' data. Stop if you hit production data you do not own. Rate-limit automated tests. Do not attack PKI, CA, or CRL availability.

SLA

We aim to acknowledge reports within 5 business days and to provide a status update within 14 days. Critical issues are prioritized. Credit is optional and listed on /security/acknowledgments after a fix ships, if you ask.