Agentic Pentesting: The Guardrails Matter More Than the Model

Getting an AI agent to attack your own web app is now easy. Any team can point a general-purpose model at a staging site and watch it fire off requests. The hard part is everything around the model: the controls that decide what it may touch, what it may do, and whether its results can be trusted. The industry has started calling that layer the harness, and it is where agentic pentesting either works or goes badly wrong.

What's happening

AI-driven offensive testing is moving from demos into production pipelines. Vendors and in-house teams are now arguing in public that the model is the easy part, and that the engineering effort belongs in the deterministic code that wraps it. Four control points keep coming up.

1. Scope

A testing agent makes thousands of choices about where to send the next request. If the only thing enforcing the rules of engagement is a sentence in its prompt, scope is a suggestion. Real web apps redirect across domains and call third-party services, so an agent can drift out of bounds without "meaning" to. Scope has to be enforced in code that inspects every outbound request before it leaves, outside the model. OWASP's guidance for agentic systems points the same way: route privileged actions through a policy engine that checks them at execution time.

2. Credentials

Pentests regularly turn up exposed secrets, so an agent will find working credentials that were never part of its assignment. Whether it may use them, for what, and with whose sign-off is a policy decision. The surrounding system has to make that call on every attempt, not the model.

3. Prompt injection

Every page, API response, hidden field and user comment the agent reads is untrusted input. One planted instruction can be enough to redirect it. OWASP ranks prompt injection as the top risk for LLM applications and says no reliable prevention exists today. So the useful question isn't whether the agent gets fooled but how much damage it can do when it does. That depends on how tightly each action is constrained and which actions need extra checks or human approval. Escalating everything to a person doesn't solve it either: reviewer fatigue at scale just moves the weak point.

4. Proof

Unverified AI findings are already a burden. Google reportedly stopped accepting product vulnerability reports to its open-source bug bounty program this month, after a surge of automated submissions that were mostly invalid. A finding that developers can't reproduce is just another ticket. Useful output needs evidence: what was reached, how, and a way to replay it safely within the same controls.

Why it matters

None of this is built once and left alone. Every model upgrade can change how the agent behaves, and every release changes the application it is testing. Teams adopting agentic testing, or buying it, should judge it by its harness: scope enforcement, credential policy, blast-radius limits, data handling (what customer data reaches a model provider, and under what retention terms), and evidence quality. Benchmark scores matter less.

What to do

• Ask where scope is enforced. If the answer is "in the prompt", treat it as unenforced. Look for out-of-model allow-lists checked on every request.
• Set a credential policy up front. Decide in writing whether discovered credentials may be used, and require explicit human approval before any authenticated step.
• Assume injection will happen. Restrict which actions the agent can take on its own, keep destructive operations off the table, and log every action so a run can be paused, stopped and audited.
• Demand reproducible evidence. Every finding should come with the request path, a severity rationale (e.g. CVSS) and a safe way to re-test after a fix.
• Control the data flow. Know what leaves your environment, which model sees it, and how long it's kept.
• Keep a human in the loop where it counts. Use people to approve the risky actions and to validate findings before they become tickets, not to rubber-stamp every request.

This is how our penetration testing team works with AI assistance: automation does the legwork, active steps run only inside a verified scope and with analyst approval, and every finding is reviewed by a person before it reaches you. The model accelerates the work, and the controls keep it safe.

Source: this analysis draws on a contributed article by Pentera, "The Harness Is the Hard Part of Agentic Pentesting", published on The Hacker News on 21 October 2026.