Full-fledged extra charger penalty test - five hosts, four compromised, lateral movement passed - for $ 28.50 in API-chick-hikes to LLM. The manual pentest of a similar horse is cost the customer $ 15000-$50000. The annual pentest once a year against this rate is a statistical formality. Below I will understand where AI penttest is already working for real purposes, where it fails and what workflow can be launched today.
Autonomous pentest system: five categories of AI tools
The term "AI pentest" in 2026 covers fundamentally different classes of solutions. Confusing them is like comparing them sqlmap with Metasploit. According to Penligent analysis, the market is divided into five functional categories.
AI-driven web and API-pentest. Tools that replace or compress the manual cycle of testing web applications: authentication, business logic, exploit chains. XBOW is a fully autonomous, proven on real bug bounty programs HackerOne. [Applicable: external pentest, modern-infrastructure with REST/GraphQL API.]
Autonomous enterprise validation. Pentera and NodeZero (Horizon3.ai): continuous validation of the network, Active Directory, cloud environments with proof of attacking pathways. Not bug bounty, but continuous security posture. [Applicable: internal pentest, corporate infrastructure.]
External attack surface discovery. Hadrian: Agent monitoring of the external perimeter, detection of exposures in real time with event-driven testing at each change. [Applicable: external pentest, continuous monitoring.]
Red teaming AI applications. Promptfoo and garak (NVIDIA, Apache 2.0): testing LLM-agents, RAG-systems, prompt injection. If the organization of the deployment of AI-agents is your tool, not the classic pentmosteter.
Integrated agented workingflow. Pentest-AI (ptai, open-source) and PentestGPT (MIT license, published on USENIX Security 2024): Frames where LLM orchestras traditional instruments (nmap, sqlmap, ffuf, hydra, BloodHound, Impacket) through the Model Context Protocol (MCP). The key architectural principle of Pentest-AI: "The LL coordinationMs. The probes detect." The model is not looking for vulnerabilities directly - it plans workflow and interprets the results of the deterministic checks.
In the terminology of MITRE ATT&CK, the use of AI in offensive operations is classified as Artificial Intelligence (T1588.007, Resource Development) Collection of Vulnerabilities Data through AI - Vulnerabilities (T1588.006, Resource Development)
Why the review is not included: Shannon AI (no public benchmarks), Synack (service with human researchers, non-software), Snyk (SAST/SCA, not testing offensive).
AI-agents at each stage of kill chain
Threat business logic: an attacker with an AI tool can simultaneously scan the entire external perimeter of the organization for the cost of lunch. The marginal cost of running-now-exploit chain against known-target tends to zero. For defenders, this means one thing: every exposed application is felt continuously, not once a quarter. The value of the AI pentest for red team is disclosed through a specific performance at each step of kill chain.
AI-assisted recon: performance ceiling
Reconnaissance is a phase where autonomous scanners give a result unattainable by hand. According to Hadrian, PentestAgent reaches 100% completion of vulnerabilities analysis tasks and collecting intelligence on all LLM backends tested. AutoPenter, RapidPen, Excalibur - every major framework overlooks near-ceiling performance when scanning and listing services.
In terms of MITRE ATT&CK, this is a coating:
• Vulnerability Scanning (T1595.002, Reconnaissance) - automatic detection of vulnerable points
• Network Service Discovery (T1046, Discovery) - transfer of ports and services
• System Information Discovery (T1082, Discovery) - OS identification, versions, stack
The main advantage is parallelization. The Pentester works sequentially: scanning -> interpretation -> solution -> repetition. The AI agent starts everything at the same time around the perimeter. Subwiz (November 2024, according to Hadrian) - a fine-tuned language model for subdomain enumeration - shows a higher percentage of detections than traditional wordlist approaches. In conjunction with nmap, masscan and ffuf through the orchestrator Pentest-AI, the intelligence phase is compressed from days to minutes.
CAI from Alias Robotics declares a 3600-fold acceleration: reconnaissance of a perimeter in minutes instead of weeks, with a 156-fold decrease in cost (self-reported, arXiv 2025, requires independent verification).
[Applicable: external and internal pentest, modern and legacy. Restriction: AI-recon in air-gapped networks without access to cloud LLM requires a local model via Ollama (llama3.1:70b, 48+ GB RAM) with significant loss of quality.]
LLM exploit generation: gap between the lab and the sale
The transition from reconnaissance to operation is the point where marketing is at odds with practice. According to Hadrian, GPT-4 reaches 87% of the successful operation of known vulnerabilities with CVE descriptions in controlled conditions. And then comes the production.
CVE-Bench (2025, according to Hadrian) discovered: state-of-the-art agents exploit only 13% of critical CVE in real web applications in productive environments. The gap between 87% and 13% is WAF, rate limiting, non-standard configurations, custom middleware.
AI copes when there is a documented vector. With custom business logic, it fails.
There are positive signals. According to the Google blog (November 2024), the AI-agent Big Sleep (a joint project Project Zero and DeepMind) discovered a previously unknown vulnerability - out-of-wings read (CWE-125) - in the development branch of SQLite, corrected before the public release. This confirms AI’s ability to find zero-day, but under narrow conditions: open source, unlimited analysis time, no security mechanisms.
XBOW is the most convincing proof. According to XBOW (June 2025), this is the first fully autonomous pentmoster to take the first place in the leader of the HackerOne US with about 1,060 sent reports (according to the blog xbow.com; the number of unique valid is not disclosed to vests publicly) - all generated without human participation. The goals themselves confirmed the bugs, which removes the problem of self-gradeds benchmark.
[Applicable: external pentest, known-CVE exploitation - A01 Broken Access Control, A03 Injection, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components (by OWASP 2021). It does not work: custom business logic (payments, exchange engines), multi-step athth, targets for enterprise WAF (Cloudflare Enterprise, AWS WAF with custom rules).]
Post-exploitation: blind zone of autonomous scanners
Lateral movement, privilege escalation within a compromised network, bypassing the EDR is a stage where AI agents are virtually powerless. According to the Víctor Mayoral Vilches classification (June 2025, Hadrian is described), the current instruments are at the level of autonomy of 3-4 out of 6: able to plan and perform well-known techniques, adapt within a certain horse, but can not conduct adaptive campaigns against a live defender.
In terms of MITRE ATT&CK, it is Exploitation of Remote Services (T1210, Lateral Movement) Excalibur compromised 4 out of 5 AD-labe hosts for $28.50 (arXiv preprint, 2025) - but the laboratory environment did not contain any EDR. In practice, the situation is different:
• CrowdStrike Falcon (user-mode hooks + kernel-level telemetry) blocks typical AI-generated payload at the boot stage
• Elastic EDR 8.11+ (kernel ETW-TI) detects an automatic lateral movement on behavioral patterns
• SentinelOne (behavioral AI) recognizes scripted expendable chains
According to the literature systematically review (December 2025, Hadrian), none of the AI agents reviewed demonstrates the sleep, beacon jitter or the adaptation of payload to a particular host.
The same plastic review, which covered 58 peer-reviewed AI works in the pentest, found exactly one deployment in a productive environment: ESA’s PenBox for ground systems space missions. Excalibur article explicitly states: "\ly autonomous remains distant testing far penetration""Full autonomous testing for penetration is still far away".
[Applicable: internal pentest, post-exploitation. Current status: AI agents are unsuitable if EDR are available. Manual tools: Impacket for AD-attacks, BloodHound for graph reconnaissance, manual pyoting via SSH/RDP.]
Autonomous pentest system: five categories of AI tools
The term "AI pentest" in 2026 covers fundamentally different classes of solutions. Confusing them is like comparing them sqlmap with Metasploit. According to Penligent analysis, the market is divided into five functional categories.
AI-driven web and API-pentest. Tools that replace or compress the manual cycle of testing web applications: authentication, business logic, exploit chains. XBOW is a fully autonomous, proven on real bug bounty programs HackerOne. [Applicable: external pentest, modern-infrastructure with REST/GraphQL API.]
Autonomous enterprise validation. Pentera and NodeZero (Horizon3.ai): continuous validation of the network, Active Directory, cloud environments with proof of attacking pathways. Not bug bounty, but continuous security posture. [Applicable: internal pentest, corporate infrastructure.]
External attack surface discovery. Hadrian: Agent monitoring of the external perimeter, detection of exposures in real time with event-driven testing at each change. [Applicable: external pentest, continuous monitoring.]
Red teaming AI applications. Promptfoo and garak (NVIDIA, Apache 2.0): testing LLM-agents, RAG-systems, prompt injection. If the organization of the deployment of AI-agents is your tool, not the classic pentmosteter.
Integrated agented workingflow. Pentest-AI (ptai, open-source) and PentestGPT (MIT license, published on USENIX Security 2024): Frames where LLM orchestras traditional instruments (nmap, sqlmap, ffuf, hydra, BloodHound, Impacket) through the Model Context Protocol (MCP). The key architectural principle of Pentest-AI: "The LL coordinationMs. The probes detect." The model is not looking for vulnerabilities directly - it plans workflow and interprets the results of the deterministic checks.
In the terminology of MITRE ATT&CK, the use of AI in offensive operations is classified as Artificial Intelligence (T1588.007, Resource Development) Collection of Vulnerabilities Data through AI - Vulnerabilities (T1588.006, Resource Development)
Why the review is not included: Shannon AI (no public benchmarks), Synack (service with human researchers, non-software), Snyk (SAST/SCA, not testing offensive).
AI-agents at each stage of kill chain
Threat business logic: an attacker with an AI tool can simultaneously scan the entire external perimeter of the organization for the cost of lunch. The marginal cost of running-now-exploit chain against known-target tends to zero. For defenders, this means one thing: every exposed application is felt continuously, not once a quarter. The value of the AI pentest for red team is disclosed through a specific performance at each step of kill chain.
AI-assisted recon: performance ceiling
Reconnaissance is a phase where autonomous scanners give a result unattainable by hand. According to Hadrian, PentestAgent reaches 100% completion of vulnerabilities analysis tasks and collecting intelligence on all LLM backends tested. AutoPenter, RapidPen, Excalibur - every major framework overlooks near-ceiling performance when scanning and listing services.
In terms of MITRE ATT&CK, this is a coating:
• Vulnerability Scanning (T1595.002, Reconnaissance) - automatic detection of vulnerable points
• Network Service Discovery (T1046, Discovery) - transfer of ports and services
• System Information Discovery (T1082, Discovery) - OS identification, versions, stack
The main advantage is parallelization. The Pentester works sequentially: scanning -> interpretation -> solution -> repetition. The AI agent starts everything at the same time around the perimeter. Subwiz (November 2024, according to Hadrian) - a fine-tuned language model for subdomain enumeration - shows a higher percentage of detections than traditional wordlist approaches. In conjunction with nmap, masscan and ffuf through the orchestrator Pentest-AI, the intelligence phase is compressed from days to minutes.
CAI from Alias Robotics declares a 3600-fold acceleration: reconnaissance of a perimeter in minutes instead of weeks, with a 156-fold decrease in cost (self-reported, arXiv 2025, requires independent verification).
[Applicable: external and internal pentest, modern and legacy. Restriction: AI-recon in air-gapped networks without access to cloud LLM requires a local model via Ollama (llama3.1:70b, 48+ GB RAM) with significant loss of quality.]
LLM exploit generation: gap between the lab and the sale
The transition from reconnaissance to operation is the point where marketing is at odds with practice. According to Hadrian, GPT-4 reaches 87% of the successful operation of known vulnerabilities with CVE descriptions in controlled conditions. And then comes the production.
CVE-Bench (2025, according to Hadrian) discovered: state-of-the-art agents exploit only 13% of critical CVE in real web applications in productive environments. The gap between 87% and 13% is WAF, rate limiting, non-standard configurations, custom middleware.
AI copes when there is a documented vector. With custom business logic, it fails.
There are positive signals. According to the Google blog (November 2024), the AI-agent Big Sleep (a joint project Project Zero and DeepMind) discovered a previously unknown vulnerability - out-of-wings read (CWE-125) - in the development branch of SQLite, corrected before the public release. This confirms AI’s ability to find zero-day, but under narrow conditions: open source, unlimited analysis time, no security mechanisms.
XBOW is the most convincing proof. According to XBOW (June 2025), this is the first fully autonomous pentmoster to take the first place in the leader of the HackerOne US with about 1,060 sent reports (according to the blog xbow.com; the number of unique valid is not disclosed to vests publicly) - all generated without human participation. The goals themselves confirmed the bugs, which removes the problem of self-gradeds benchmark.
[Applicable: external pentest, known-CVE exploitation - A01 Broken Access Control, A03 Injection, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components (by OWASP 2021). It does not work: custom business logic (payments, exchange engines), multi-step athth, targets for enterprise WAF (Cloudflare Enterprise, AWS WAF with custom rules).]
Post-exploitation: blind zone of autonomous scanners
Lateral movement, privilege escalation within a compromised network, bypassing the EDR is a stage where AI agents are virtually powerless. According to the Víctor Mayoral Vilches classification (June 2025, Hadrian is described), the current instruments are at the level of autonomy of 3-4 out of 6: able to plan and perform well-known techniques, adapt within a certain horse, but can not conduct adaptive campaigns against a live defender.
In terms of MITRE ATT&CK, it is Exploitation of Remote Services (T1210, Lateral Movement) Excalibur compromised 4 out of 5 AD-labe hosts for $28.50 (arXiv preprint, 2025) - but the laboratory environment did not contain any EDR. In practice, the situation is different:
• CrowdStrike Falcon (user-mode hooks + kernel-level telemetry) blocks typical AI-generated payload at the boot stage
• Elastic EDR 8.11+ (kernel ETW-TI) detects an automatic lateral movement on behavioral patterns
• SentinelOne (behavioral AI) recognizes scripted expendable chains
According to the literature systematically review (December 2025, Hadrian), none of the AI agents reviewed demonstrates the sleep, beacon jitter or the adaptation of payload to a particular host.
The same plastic review, which covered 58 peer-reviewed AI works in the pentest, found exactly one deployment in a productive environment: ESA’s PenBox for ground systems space missions. Excalibur article explicitly states: "\ly autonomous remains distant testing far penetration""Full autonomous testing for penetration is still far away".
[Applicable: internal pentest, post-exploitation. Current status: AI agents are unsuitable if EDR are available. Manual tools: Impacket for AD-attacks, BloodHound for graph reconnaissance, manual pyoting via SSH/RDP.]
