Agentic AI pentesting: how autonomous agents test web apps

What "agentic" means here

A scanner runs a fixed list of checks against a target. An agent decides what to do next, based on what it just observed. The difference matters: real intrusions are sequences of reasoning, not signature matches.

An agentic pentest system is a coordinated set of LLM-powered agents, each specialised, that share a model of the target and take turns deciding the next attack step. It is closer in shape to a junior red team led by a senior than to a Nessus scan.

The core architecture

Three layers.

1. The discovery layer. Crawlers, fuzzers, and recon agents map the attack surface: endpoints, parameters, subdomains, authentication flows, third-party libraries, error patterns. Output is a structured representation of the target. We call ours the Coverage Graph: a hierarchical data structure that tracks what has been seen, what has been tested, and what remains unexplored.

2. The reasoning layer. A planning agent reads the Coverage Graph and proposes attack chains. "This endpoint accepts a UUID and returns user data, the auth token comes from a JWT signed with HS256, the session resumes via a refresh token that is not bound to the device. Try a horizontal IDOR plus a refresh-token replay." That is reasoning, not a rule.

3. The execution and validation layer. Specialised agents execute: an injection agent, an auth agent, a logic-flaw agent, an SSRF agent. Each one tries the planned attack, observes the response, refines, and either validates the finding with a working PoC or marks the hypothesis as failed. No PoC, no finding.

A scanner alerts. A pentester proves. Agentic systems prove because validation is part of the loop, not a downstream step.

Why open-weight models matter

Many AI pentest systems wrap a closed-model API. That works in a demo, fails in regulated environments. Three reasons:

1. Data residency. Sending source code or production traffic samples to a US-hosted model breaks DORA's data-localisation expectations and most NIS2 critical-infrastructure operator policies.
2. Cost at scale. Closed-model token costs make per-engagement economics impossible at the €4,000 per web app price point. Open-weight inference on dedicated GPUs runs at €20 to €25 of compute per pentest.
3. Fine-tuning. A pentest agent gets better when you train on real engagement traces. You cannot do this on a closed API.

We run on open-weight models (gpt-oss-120b, gpt-oss-20b, Kimi K2.5) hosted on Scaleway in France. Sovereign by construction.

What it does well, where it is still developing

Strong in 2026:

• Web application logic (auth, authorization, IDOR, injection families, business-logic chains on standard CRUD).
• REST and GraphQL APIs (introspection, broken object-level auth, mass assignment).
• External infrastructure (subdomain takeover, exposed services, misconfigured TLS).

Still developing:

• Active Directory and Kerberos-heavy internal network.
• Social engineering and phishing simulations.
• Bespoke business logic on multi-actor industrial workflows.

Honest map. Pair the continuous AI layer with one annual human engagement for the third bucket.

What you get out

A pentest report that looks like a senior consultant wrote it: scope, methodology, findings, reproduction steps, screenshots, remediation, retest plan. Plus the things a human cannot ship: structured machine-readable findings, signed evidence, integration with Jira and your compliance platform, pentests you launch on demand at marginal cost, with scanners running continuously in between.

If you want to see one running on your own surface, request a demo.

Related reading

• Automated vs manual pentesting: where each one wins, by surface and depth.
• Pentest cost in Europe 2026: why agentic pricing is 10x lower at comparable depth.
• Why annual pentests are broken: the case for continuous testing on SaaS.
• Sovereign EU AI pentest: CLOUD Act, Schrems II, and the EU AI Act in 2026.