AI penetration testing: what an AI pentest agent actually does

Introduction

Eighteen months ago, "AI pentest" mostly meant a chatbot you consulted between two Burp requests. Today the phrase covers products that send requests to your production themselves, chain findings together and write the report. In between, the market changed in nature, and the vocabulary did not follow.

We build one of these products, and we have spent the year answering the same question in demos: "concretely, what does the AI do that a scanner does not?". This article is the long answer. It defines what an AI-driven penetration test is, explains how a pentest agent works, says what it finds and what it will not find, and gives the questions to ask before signing.

For those who will not read further: a well-made AI pentest is not a chattier scanner. It is a classic detection engine, plus an agent that attempts exploitation the way a pentester would, across your whole perimeter, every day. And it still does not replace a human on the business logic of your main application.

Three things people call "AI pentest"

Before comparing, you have to sort. Under the same label, three products are sold today that have little in common.

All three are legitimate. The first makes a report more readable, which is not nothing when you have already received 400 pages of raw scan output. The second makes a good pentester faster. But only the third changes what gets found, because only the third makes testing decisions nobody had written down in advance.

The test to know which one you are facing: ask who decided to send a given request. If the answer is "a rule", it is a scanner. If it is "a consultant", it is an assistant. If it is "the agent, based on what it had observed two requests earlier", you are looking at an agentic pentest.

How a pentest agent works

A pentest agent is a language model placed in a loop, with tools and limits. The mechanism fits in four steps, which we ended up showing as such on our home page because it explains the product better than a paragraph.

1. Observe. The agent reads what the target returns: headers, forms, API routes found in a JavaScript bundle, an error message that says too much. It also starts from what the algorithmic engine has already recorded.
2. Hypothesize. From these observations, it forms an attack hypothesis suited to the stack. "This url parameter in an import function looks like an SSRF entry point", for instance. This is the step a scanner does not do: the scanner applies a list, the agent chooses.
3. Test. It sends the request that confirms or rules out the hypothesis, with a non-destructive payload. It reads the response, and it is allowed to be wrong.
4. Prove, or start over. If the hypothesis holds, it keeps the request, the response and the data reached: that is the proof that will go in the report. Otherwise it goes back to step 1 with one more piece of information.

The difference with a scanner shows over time. A scanner sends its thousand payloads, forward, and stops. An agent may spend twenty requests on a single form because the third response intrigued it, and that is exactly what a human pentester does in front of odd behaviour.

What the agent does not decide alone

An agent without limits is an attack tool, not an audit product. The guardrails are part of the product, and they are what to look at first in a demo:

• The perimeter is imposed. The agent only tests assets validated by the mapping engine and attached to the customer's domain. It does not "follow" a link to a third party.
• Payloads are bounded. Proving a SQL injection by reading the database version, yes. Reading the users table, no. Proving code execution with a harmless command, yes. Installing anything, no.
• Throughput is capped, and tests that can degrade a service (brute force, large payloads) are excluded by default.
• Every request is logged, so the customer can see what was sent to their production, and when.

At Flawfence, the agent never works alone anyway: it picks up the findings of an algorithmic engine that first rebuilt the perimeter, identified services and checked every asset against known flaws. The engine is deterministic and exhaustive, the agent is curious and selective. We described the inner workings of this loop in our article on AI pentest agents.

What an AI pentest finds that a scanner does not

These are the cases that keep coming back on our perimeters, not a theoretical list.

Flaws that require chaining. A staging subdomain (found by the mapping), exposing a Swagger (found by the engine), with a route that accepts a URL as a parameter (read by the agent), which reaches the cloud metadata (proven by the agent). No scanner rule describes this chain, because it only exists at this customer.

Behaviours, not versions. A scanner recognises a vulnerable product by its banner. An agent notices that a route returns different data depending on an identifier it is not supposed to accept, without knowing which product sits behind.

Isolated forms. A back-office import function, a webhook entry point, an export endpoint: what is referenced nowhere and that only someone who reads the JavaScript will find.

Contextual misconfigurations. An overly permissive CORS policy only matters if a sensitive API sits behind it; an agent that has seen the API can say so, a scanner reports it every time, or never.

On one point, automation wins without debate, and we had already written it about automated pentesting in general: frequency. An agent that comes back every day sees the flaw the day a deployment introduces it. No consultant, however good, is there on that day.

What it will not find

The part the brochures leave out. It matters because that is where bad purchases are decided.

Business logic that requires understanding your activity. Approving your own expense report, ordering at a negative price, skipping the payment step. An agent can sometimes stumble on these, but it does not know what "should not be possible" means at your company. You would have to explain your business rules to it, and the day you do, it is a scoped application pentest, not a subscription.

The authenticated area you did not open to it. An external agent without an account sees what an anonymous visitor sees. That is a lot, and it is what an opportunistic attacker sees. It is not your SaaS customer area.

The internal network. An external pentest, agentic or not, stops at the Internet boundary. Active Directory, lateral movement, privilege escalation: that is another trade and other tools.

The human. Phishing, the call to support, the borrowed badge. An agent tests machines, a red team tests an organisation.

And one limitation specific to language models, which has to be said plainly: an agent can convince itself of a flaw that does not exist. It reads an ambiguous response, builds a coherent story and reports it with confidence. The only serious countermeasure is to accept in the report only what comes with reproducible proof: the request, the response, the data. A "probable vulnerability" without a request is not a finding, it is an opinion.

The specific risks, and what to demand

An AI pentest adds three questions that classic automated pentesting did not raise.

Where does what the agent reads go? The agent reasons on HTTP responses from your production, which may contain personal data, tokens, database excerpts. Those responses go through a language model. Whose, in which country, kept how long, used to train what? A vendor who does not answer precisely has not looked. We explained why this question has a sovereign answer in our article on French AI pentesting.

Who is responsible for one request too many? An agent decides its own requests. If it sends one that degrades your service, the contract must say what was authorised. Look at the list of tests excluded by default and whether you can define time windows. And let us restate the legal obvious: automated, agentic or manual, a test without the system owner's authorisation is a criminal offence in most jurisdictions (article 323-1 of the French Criminal Code, the Computer Misuse Act in the UK, the CFAA in the US). A tool that tests any domain typed into a form, without attestation, exposes its customer as much as itself.

Is the result reproducible? Two runs of an agent on the same target do not necessarily follow the same path. That is a strength (it explores) and a weakness (it may miss on the second run what it found on the first). A good product keeps confirmed findings from one run to the next and explicitly retests them, instead of relying on luck.

How to evaluate an AI pentest offer

Six questions, to ask the technical person.

1. Show me the loop. On a real finding, which requests did the agent send before the one that proved the flaw? If there is only one, it is a rule, not an agent.
2. What is the agent not allowed to do? The answer must be a list, not a reassuring sentence.
3. Where does the model run, and what does it see? Host, country, retention, training.
4. How do you measure your false positives? Validation through exploitation is a measurement. A third party judging (a bug bounty programme, a counter-audit) is a better one.
5. What happens when the agent is wrong? How is a non-reproducible finding handled? Is it published, retested, discarded?
6. What does your agent not find? A vendor with no answer does not know their product.

For amounts, our security audit price guide still holds: a year of continuous agentic coverage sits in the same order of magnitude as a short external pentest.

Where Flawfence stands

Since we ask others question 6.

Flawfence combines both layers. An algorithmic engine rebuilds the perimeter from the domain, identifies services and checks every asset against known flaws and OWASP tests, on every run, deterministically. An AI pentest agent then picks up its findings, explores the applications found, forms its hypotheses and attempts exploitation with non-destructive payloads. Nothing is reported without proof: request, response, data reached, and the command to replay. The agent reasons primarily with Mistral AI models, and the platform is hosted in Paris.

On false positives, our measurement is public: the engine and the agent run on bug bounty programmes, where a flaw only counts if the targeted company validates it. The results are on our YesWeHack profile and shown on the home page.

What Flawfence does not find: business logic that requires knowing your rules, the authenticated area, the internal network, and the human. For the application that carries your revenue, keep a budget for an application pentest. We will tell you if that is what you need.

FAQ

What is an AI pentest?

A penetration test in which an artificial intelligence makes testing decisions: it observes the target, forms attack hypotheses, verifies them by sending requests and keeps the proof. It is also called an agentic pentest. Not to be confused with a scanner whose results are merely summarised by an AI, nor with an assistant that helps a human pentester.

Does an AI pentest replace a manual pentest?

Not entirely. It covers technical flaws, misconfigurations, forgotten assets and chains that do not require understanding the business better and more often. It does not replace a human on the business logic of a critical application, nor on the authenticated area or the internal network.

What is the difference between an AI pentest and a vulnerability scanner?

The scanner applies rules written in advance and reports matches. The pentest agent chooses its tests from what it observes, chains several findings and attempts exploitation to prove the flaw. The scanner is exhaustive and reproducible, the agent is selective and adaptive. The best products combine both.

Is an AI pentest agent dangerous for production?

It can be if it has no limits. A serious product imposes the perimeter, bounds payloads to the proof (no reading or modifying data), caps throughput, excludes degrading tests by default and logs every request. Ask for the list of what the agent is not allowed to do.

Is the data read by the agent sent to a foreign model?

It depends on the vendor. The agent reasons on responses from your production, which go through a language model. Ask where the model runs, in which country, with what retention and whether it is trained on your data. Flawfence primarily uses Mistral AI models and hosts the platform in France.

How much does an AI pentest cost?

External subscription offers sit in the order of magnitude of one short external pentest per year for an SME, and grow with the number of assets. At Flawfence, the subscription starts at €5,000 excl. tax per year.

Conclusion

The word "AI" on a pentest brochure says nothing until you know who decides to send the requests. If it is a rule, you are buying a scanner, and there are good ones. If it is an agent that observes, hypothesizes, tests and proves, you are buying something new: a pentester that does not sleep, bounded by guardrails you must read before signing.

In both cases, demand the proof. A report that does not contain the request and the response does not tell you what is exploitable at your company. It tells you what a language model thinks might be, and that is not the same thing.