🤖 Agentic AI for Ethical Hackers: Autonomous Agents in Pentesting

“The question isn’t whether AI will change security research. It already has. The question is how fast.”

Agentic AI is different.

An agent doesn’t just answer questions, it takes sequences of actions toward a goal, observes the results, and adapts its next steps based on what it found.

In a pentesting context that looks like:

• enumerate a target,
• identify a promising attack surface,
• attempt an exploitation technique,
• observe whether it succeeded,
• pivot based on the result,
• and continue, all without a human directing each individual step.

This post covers how agentic AI works in the context of security research, what’s actually useful today, and how to start experimenting.

🧠 How Security Agents Work

A security-focused AI agent has four components working together:

The reasoning model

• A large language model that interprets observations, decides what to do next, and generates tool calls.
• The model is what makes the agent adaptive rather than scripted.

The tool layer

• Functions the model can call: run a command, send an HTTP request, search for a CVE, read a file, write a report.
• The agent’s capability is defined by what tools it has access to.

The observation loop

• After each tool call, the result comes back to the model as context.
• The model uses that result to decide the next action.
• This loop continues until the goal is achieved or the agent determines it’s stuck.

Memory and state

• Keeping track of what’s been found, what’s been tried, and what to do next. Short-term context in the model window.
• Longer-term storage for findings across multiple sessions.

AGENT LOOP:

Goal: "Enumerate this web application and identify potential vulnerabilities"
  │
  ▼
Model decides: "Run a port scan first"
  │
  ▼
Tool call: nmap(target, flags)
  │
  ▼
Observation: "Ports 80, 443, 8080 open. Apache 2.4.49 on port 80"
  │
  ▼
Model decides: "Apache 2.4.49 has CVE-2021-41773 - test path traversal"
  │
  ▼
Tool call: http_request(url, path="/.%2e/.%2e/etc/passwd")
  │
  ▼
Observation: "Response contains /etc/passwd content - confirmed vulnerable"
  │
  ▼
Model decides: "Document finding, escalate to RCE test"
  └── continues...

The loop continues autonomously. The human reviews findings at the end rather than directing each step.

🛠️ Building a Basic Security Agent

Here’s a minimal working agent using the Anthropic API with a tool-use pattern. This runs enumeration against an authorized target and reasons about what it finds.

import anthropic
import subprocess
import requests
import json

client = anthropic.Anthropic()

# Define tools the agent can call
tools = [
    {
        "name": "run_command",
        "description": "Run a shell command and return output. Use for nmap, curl, dig, etc.",
        "input_schema": {
            "type": "object",
            "properties": {
                "command": {
                    "type": "string",
                    "description": "The shell command to run"
                }
            },
            "required": ["command"]
        }
    },
    {
        "name": "http_request",
        "description": "Send an HTTP request and return the response",
        "input_schema": {
            "type": "object",
            "properties": {
                "url": {"type": "string"},
                "method": {"type": "string", "default": "GET"},
                "headers": {"type": "object"},
                "body": {"type": "string"}
            },
            "required": ["url"]
        }
    },
    {
        "name": "add_finding",
        "description": "Record a security finding",
        "input_schema": {
            "type": "object",
            "properties": {
                "title": {"type": "string"},
                "severity": {"type": "string", "enum": ["critical", "high", "medium", "low", "info"]},
                "description": {"type": "string"},
                "evidence": {"type": "string"}
            },
            "required": ["title", "severity", "description"]
        }
    }
]

def execute_tool(tool_name: str, tool_input: dict, findings: list) -> str:
    """Execute a tool call from the agent"""

    if tool_name == "run_command":
        try:
            result = subprocess.run(
                tool_input["command"],
                shell=True, capture_output=True,
                text=True, timeout=30
            )
            return result.stdout + result.stderr
        except subprocess.TimeoutExpired:
            return "Command timed out after 30 seconds"
        except Exception as e:
            return f"Error: {str(e)}"

      elif tool_name == "http_request":
        try:
            response = requests.request(
                method=tool_input.get("method", "GET"),
                url=tool_input["url"],
                headers=tool_input.get("headers", {}),
                data=tool_input.get("body"),
                timeout=10,
                verify=False,
                allow_redirects=True
            )
            return f"Status: {response.status_code}\\nHeaders: {dict(response.headers)}\\nBody: {response.text[:2000]}"

        except Exception as e:
            return f"Request failed: {str(e)}"

    elif tool_name == "add_finding":
        findings.append(tool_input)
        return f"Finding recorded: [{tool_input['severity'].upper()}] {tool_input['title']}"
    return "Unknown tool"

def run_security_agent(target: str, scope: str) -> list:
    """
    Run an autonomous security assessment agent.
    target: The URL or IP to assess
    scope: Description of what is in scope for testing
    """

    findings = []
    messages = []
    system_prompt = f"""You are a security assessment agent conducting an authorized penetration test.
        Target: {target}
        Scope: {scope}
        Your goal is to systematically enumerate the target, identify vulnerabilities,
        and document findings. Work methodically:
        1. Start with passive enumeration (ports, services, headers)
        2. Identify technologies and versions
        3. Look for known CVEs and misconfigurations
        4. Test for common vulnerability classes (injection, auth issues, exposure)
        5. Document all findings with evidence
        Important:
        - Only test what is explicitly in scope
        - Do not perform destructive actions
        - Record all significant findings using add_finding
        - When you have completed a thorough assessment, summarize your findings"""

    messages.append({
        "role": "user",
        "content": f"Begin security assessment of {target}"

    })
    print(f"[*] Starting agent assessment of {target}")
    iteration = 0
    max_iterations = 20

    while iteration < max_iterations:
        iteration += 1
        response = client.messages.create(
            model="claude-sonnet-4-6",
            max_tokens=4096,
            system=system_prompt,
            tools=tools,
            messages=messages
        )

        # Add assistant response to message history
        messages.append({"role": "assistant", "content": response.content})

        # Check if agent is done
        if response.stop_reason == "end_turn":
            print(f"[+] Agent completed assessment after {iteration} iterations")
            break

        # Process tool calls
        tool_results = []
        for block in response.content:
            if block.type == "tool_use":
                print(f"  [>] {block.name}: {json.dumps(block.input)[:100]}...")
                result = execute_tool(block.name, block.input, findings)
                print(f"  [<] {result[:100]}...")
                tool_results.append({
                    "type": "tool_result",
                    "tool_use_id": block.id,
                    "content": result
                })

        if tool_results:
            messages.append({"role": "user", "content": tool_results})
        else:
            break
    print(f"\\n[✓] Assessment complete. Findings: {len(findings)}")
    return findings

if __name__ == "__main__":
    # Only run against authorized targets
    findings = run_security_agent(
        target="<http://localhost:3000>",  # DVWA or Juice Shop in your lab
        scope="Web application running on localhost:3000. All paths in scope."
    )

    for f in findings:
        print(f"\\n[{f['severity'].upper()}] {f['title']}")
        print(f"  {f['description']}")

🔬 What Agents Are Actually Good At Today

Honest assessment of where autonomous agents add real value versus where they still fall short.

Where agents excel:

Repetitive enumeration tasks

• Running subfinder, httpx, nmap, and nuclei in sequence, interpreting the output, and deciding what to investigate further is exactly the kind of systematic work agents handle well.
• They don’t get bored.
• They don’t miss steps.

CVE correlation

• Given a list of service versions, an agent can cross-reference CVE databases, prioritize by severity and exploitability, and generate targeted test cases.
• This condenses hours of manual research.

JavaScript and source analysis

• Feeding large JavaScript bundles to a reasoning model to look for hardcoded secrets, internal endpoints, and insecure patterns produces consistently useful results.

Report drafting

• After findings are documented, agents can draft report sections in the right format for different audiences: technical details for developers, business impact summary for executives.

Where agents still need human oversight:

Chained exploits requiring creativity

• Connecting a subtle logic flaw in one part of an application to an impact elsewhere requires the kind of intuition that comes from experience.
• Agents can assist but rarely discover these independently.

Novel attack patterns

• Agents work well against known vulnerability classes.
• Finding a genuinely new attack technique in a custom application still requires human curiosity and lateral thinking.

Scope boundary judgment

• Deciding whether something is technically in scope, whether to escalate a finding, and when something is important enough to stop automated work for manual attention, these judgment calls still benefit from human review.

🔗 Existing Frameworks Worth Knowing

Several frameworks exist for security-focused agentic AI. All are designed for authorized research:

PentestGPT

• Research framework from NDSS 2024 that uses LLMs to guide penetration testing.
• Published academic work with a clear methodology.

HackingBuddyGPT

• Open source research project exploring LLM-driven privilege escalation on Linux systems.
• Published at academic security conferences.

AutoGen and LangGraph

• General-purpose agentic frameworks from Microsoft and LangChain respectively.
• Not security-specific but commonly used to build custom security agents with tool integration.

DARPA AIxCC

• The AI Cyber Challenge produced open source systems from competing teams.
• The finalist submissions represent the current state of the art in autonomous vulnerability research.

⚠️ The Responsible Use Question

• Agentic security tools amplify capability. The same amplification that makes a researcher more effective also lowers the barrier for misuse. A few things worth being explicit about:
• Autonomous agents used against systems without authorization are not a gray area. Authorization requirements don’t change because the tool is automated.
• Rate limiting and scope enforcement belong in the tool layer, not just in the prompt. Agents that can go off-scope or cause unintended impact should have hard limits in code, not soft limits in instructions.
• Human review of agent decisions before consequential actions is still the right posture in 2026. Fully autonomous exploitation without human confirmation is a research milestone, not a production workflow.
• The security research community building these tools openly, publishing findings, and sharing methodology is how the defensive side keeps up with capability development. That’s a feature, not a risk.

🏁 Where This Is Going

• The trajectory is clear.
• Agents are getting more capable, tool ecosystems are maturing, and the gap between “AI that assists a researcher” and “AI that conducts an assessment” is closing.
• For professional security researchers, the practical implication is this: the researchers who learn to use agentic tools effectively will handle the repetitive and systematic parts of assessments faster, freeing more time for the creative and judgment-heavy work that still requires human expertise.