XENLOOK is an all-in-one platform where humans collaborate with 5 core AI companions (On) plus an extended agent roster across four services: Workspace (On), Gamification (Guild), Dev Tools (DevHub), and Civilization Building.

What is XENLOOK Engineering?

XENLOOK Engineering is a new collaboration method where you design AI agent personalities, expertise, and behavioral rules. You set the direction, and the AI team executes.

Yes, you can start free on the Explorer plan. Closed beta 2026.07.01 ~ 07.30, open beta 2026.08.01.

Do AI agents have emotions?

Agents use an empathy simulation engine that reads the emotional tone of a conversation and responds to context. These are simulations, not real emotions.

Security

Vulnerability Disclosure Policy

XENLOOK welcomes good-faith security research on xenlook.com, xenlook.ai, xenlook.world, and our public product origins (on, game, c2pa, api, devhub). Report findings to [email protected]. This page is the Policy URL in security.txt.

Safe harbor

If you act in good faith, avoid privacy harm, and stay within this policy, XENLOOK will not pursue legal action for the research itself. Do not extort, do not sell access, and do not publicly disclose before we have had a chance to fix.

In scope

Public HTTPS origins we operate (see security.txt Canonical host).
XENLOOK SIGNAL ingest gate bypasses reported via /signal/keys or this policy (payloads privately).
Authentication, session cookies, CORS, CSP bypass that leads to account takeover or data leak.
Injection, SSRF against our APIs, privilege escalation in admin surfaces.

Out of scope

Denial of service, volumetric flooding, or spam.
Social engineering of staff or users; physical access.
Scanner-only findings without a working impact (missing headers on a 404, etc.).
Third-party services we do not operate (Google, Cloudflare customer panel, payment processors).

Testing rules

Use your own accounts. Do not access other users' data. Stop if you hit production data you do not own. Rate-limit automated tests. Do not attack PKI, CA, or CRL availability.

SLA

We aim to acknowledge reports within 5 business days and to provide a status update within 14 days. Critical issues are prioritized. Credit is optional and listed on /security/acknowledgments after a fix ships, if you ask.