AI Pentesting: What Agents Find and What Needs a Human

Video transcript

Can AI pentest as well as a human? Not across a whole engagement yet. Agents find many technical flaws, but some work still needs people.

The progress is real. DARPA's AI Cyber Challenge finalists found 54 of 63 planted vulnerabilities, and 18 real ones.

XBOW topped HackerOne's US leaderboard. Big Sleep found a SQLite memory bug, and Aardvark found at least ten CVEs.

Agents excel at scale, analyzing over 54 million lines of code, at speed, with patches in 45 minutes on average, and on known classes like injection and SSRF.

Unconfirmed findings are leads, not results, so ask how findings are validated. XBOW confirms that an XSS payload actually runs in a headless browser.

Humans still lead on business logic, like a withdrawal that runs twice. On chained flows, where low-risk bugs combine into a path to funds. And on judging impact.

Strong programs use both. Agents run continuously on known classes. Humans attack value flows and verify every finding before it reaches you.

Guardian's Helix runs hundreds of parallel agents across your stack, and only human-verified findings reach clients. Offchain testing is led by Carlos Polop, co-founder of HackTricks.

Read the full article for the questions to ask any vendor, or talk to Guardian.

In June 2025, XBOW said its autonomous pentester had reached the top of HackerOne's US leaderboard. It competed alongside thousands of human researchers.

In August 2025, finalists in DARPA's AI Cyber Challenge found 54 of 63 planted vulnerabilities, and 18 real ones.

The useful question for an exchange or fintech is now narrower: which flaws do agents find, and which still need a person?

How AI Pentesting Works

AI pentesting uses language-model agents to do parts of a tester's job: map the target, form hypotheses, try exploits and check the results.

Products sit on a spectrum:

• Autonomous: agents run the test end to end; people review the output.
• AI-assisted: human testers direct agents and verify every finding.
• Continuous: agents rerun as code and infrastructure change.

Two published designs show the loop.

XBOW runs validators before it reports. A headless browser, for example, confirms that an XSS payload actually executes.

OpenAI's Aardvark, announced in October 2025, builds a threat model and scans incoming changes. It tries to trigger each issue in a sandbox, then drafts a patch with Codex, The Hacker News reported.

Validation is the step to ask about. An unconfirmed finding is a lead, not a result. For contract code, see what an AI smart contract audit is.

What the Public Evidence Shows

XBOW on HackerOne

XBOW says programs resolved 130 of its reports and triaged 303. Another 208 were duplicates and 209 informative.

Over 90 days, program owners rated 54 of its findings critical and 242 high.

Its classes: remote code execution, SQL injection, XXE, path traversal, SSRF, XSS, cache poisoning and secret exposure. XBOW says the hard part is often precision, not detection.

DARPA's AI Cyber Challenge

DARPA announced the final results on August 8, 2025. Team Atlanta won, ahead of Trail of Bits and Theori.

Of the 18 real vulnerabilities, six were in C code and 12 in Java.

DARPA later corrected the planted total from 70 to 63. The 54 found stayed the same.

Google's Big Sleep

Big Sleep, from Project Zero and Google DeepMind, found a stack buffer underflow in SQLite. It "remained undiscovered after 150 CPU-hours of fuzzing."

Google also wrote that "a target-specific fuzzer would be at least as effective."

In July 2025, Google said Big Sleep found CVE-2025-6965, a SQLite flaw "known only to threat actors and at risk of being exploited."

Where Agents Are Strong

• Scale: AI Cyber Challenge systems analyzed over 54 million lines of code.
• Speed: their patches took 45 minutes on average.
• Cost: about $152 per competition task, DARPA says.
• Known classes: injection, SSRF, XSS and memory corruption.
• Change coverage: Aardvark checks incoming changes, not just a snapshot.

Most of these results are flaws a machine can confirm: a payload runs, or memory is corrupted.

Where Humans Still Lead

Three kinds of work still depend on a tester's judgment.

Business logic

OWASP says business logic flaws "cannot be detected by a vulnerability scanner." Finding it relies on "the skills and creativity of the penetration tester."

A withdrawal that runs twice under parallel requests is valid traffic each time. Only someone who knows the rules sees the second one as theft. Our crypto exchange pentesting guide lists those test cases.

Chained flows

NIST, writing about scanners, warned that "several low-risk vulnerabilities" can "present a higher risk when combined." A tool may rate each one low.

A path to funds can run that way: a leaked token, a missing check, then a service that signs.

Judgment on impact

Severity depends on what a finding reaches: funds, keys or customer data. That takes knowledge of the business.

Context also decides what counts. XBOW says many informative reports came from programs that exclude certain classes or third-party issues.

And accountability stays human. HackerOne's policy on automated tools meant XBOW's team reviewed reports before they went out.

A Combined Program

Ask any AI pentest vendor:

• Who verifies each finding before it reaches us?
• Is each finding proven by an exploit, or a model's opinion?
• Which vulnerability classes do you not claim to cover?
• Which roles and credentials do the agents test with?
• What may agents do in production, and what stops them?
• How are duplicates and false positives handled?

For the same model on contract code, read what a hybrid AI and human smart contract audit is.

How Guardian Combines Both

Helix is Guardian's proprietary AI security agent pipeline, the engine behind its audits.

In Managed Security, Helix runs continuously across contracts, backend services, infrastructure and web apps, with hundreds of parallel agents.

Humans verify the context, configuration and depth. Only human-verified findings reach the client, each with a fix PR attached.

Shield is Guardian's continuous coverage of everything a client has facing the internet. It runs reconnaissance and penetration testing around the clock, verified by a Guardian researcher.

Guardian's offchain services are led by Carlos Polop, Head of Offchain Services. He co-founded and built HackTricks training into one of the most popular online cybersecurity training and certification sites.

He also coached team Europe to victory in ICC 2025 in Japan. Guardian's offchain pentests cover web apps, APIs, infrastructure and offchain automation.

Frequently Asked Questions

Can AI do penetration testing as well as a human?

Not across a full engagement. Agents such as XBOW find and validate many technical flaws at scale. Business logic, chained attack paths and judging real impact still depend on human testers, so the strongest programs combine both.

What is autonomous pentesting?

A test in which AI agents run reconnaissance, exploitation and validation without step-by-step human direction. XBOW says its system requires no human input, yet its team reviewed reports before submitting them, to comply with HackerOne's policy on automated tools.

Can AI find business logic vulnerabilities?

Rarely on its own. OWASP says business logic flaws cannot be detected by a vulnerability scanner and rely on the tester's creativity. The public AI results we reviewed center on technical classes such as injection, SSRF and memory bugs.

How should a security team use AI pentesting?

Run agents continuously for coverage and known vulnerability classes, and point human testers at value flows, chained paths and impact. Require that every finding is validated and reviewed by a person before it reaches your backlog.

Sources

• XBOW: The Road to Top 1, How XBOW Did It (June 24, 2025)
• DARPA: AI Cyber Challenge final competition results (August 8, 2025)
• Google Project Zero: From Naptime to Big Sleep (November 1, 2024)
• Google: Cybersecurity updates for summer 2025, by Kent Walker (July 15, 2025)
• The Hacker News: OpenAI Unveils Aardvark, GPT-5 Agent That Finds and Fixes Code Flaws Automatically (October 31, 2025)
• OWASP WSTG v4.2: Introduction to Business Logic
• NIST: SP 800-115, Technical Guide to Information Security Testing and Assessment (September 2008)
• Guardian: Managed Security
• Guardian: Team
• Guardian: Audits and pentests