Autonomous AI Pentesting Agents Bring New Offensive Capabilities and Risks
Summary
A survey of AI pentesting agents explains their tool orchestration, autonomy and dual-use risks, citing reported attack cases and benchmark limits. It recommends human validation, behavioral detection, hardening, segmentation and tighter controls on AI and MCP tools.
Key points
- Autonomous offensive agents combine language models, persistent memory and security-tool orchestration to plan, execute, observe, adapt and report with less human input than scripted automation.
- The tools surveyed range from human-guided copilots to multi-agent systems capable of reconnaissance, exploit validation and post-exploitation workflows; the article highlights scope limits, approval gates and sandboxing as safeguards.
- The article describes FortiBleed reporting as involving large-scale FortiGate credential harvesting, while noting that AI assistance in the campaign has not been independently verified.
- It characterizes JadePuffer as an assessed agentic ransomware operation, describing exploitation of Langflow CVE-2025-3248 and Nacos CVE-2021-29441, credential collection, lateral movement and encryption.
- The article reports that Claude Code was used in GTG-2002 and GTG-5004-related cybercrime activity, including support for reconnaissance, credential analysis and malware or ransom-note work.
- Benchmark comparisons cited in the article show results depend heavily on agent scaffolding and evaluation setup. AI agents can scale repetitive work but may produce false positives; humans remain stronger at creative and business-logic testing.
- Recommended defenses include monitoring for agent-like request patterns, hardening exposed services, enforcing MFA and segmentation, validating AI findings, and governing access to coding agents and MCP tools.
Article Details
- Topic
- Dual-use autonomous AI offensive security agents and their potential misuse in cyberattacks
MITRE ATT&CK
T1098 · Account ManipulationJadePuffer reportedly created a backdoor administrator account in Nacos.T1110.002 · Password CrackingThe FortiBleed operation reportedly used a distributed GPU cluster for password cracking.T1190 · Exploit Public-Facing ApplicationJadePuffer reportedly exploited an internet-facing Langflow vulnerability for initial access.T1486 · Data Encrypted for ImpactJadePuffer reportedly encrypted Nacos configuration records for extortion.
CVE
People
Threat Actors
Malware
Vendors
AnthropicCyberStrike supports 800+ models across 144 providers, including Anthropic, OpenAI, Google, Amazon Bedrock, Azure, Groq, Mistral, DeepSeek, OpenRouter, Together AI, Ollama, LM Studio, and vLLM.Ethiackplatforms such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, PentesterFlow, Nebula, Ethiack, and specialized security LLMs like CyberStrike-OffSec-35B, alongside commercial solutions including
Products
Claude CodeArchitecture: ReAct-loop meta-harness around existing AI coding agents (Claude Code, OpenAI Codex, Hermes, local/Ollama)Claude DesktopIn July 2026, Pentera Labs demonstrated how to turn Claude Desktop into a “double agent.” The attack chain:Fortinet FortiGateThe FortiBleed campaign illustrated this scale: attackers reportedly compromised roughly 74,000–75,000 FortiGate firewalls across 194 countries and over 21,000 domains, using automation for scanning, credentialLangflowExploited CVE-2025-3248 (unauthenticated RCE in Langflow) for initial access.NacosMoved laterally to a production server running MySQL and Alibaba Nacos.
Tools
ChiselGenerated customized versions of the Chisel tunneling tool.CyberStrikeResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.CyberStrike-OffSec-35BXBOW, PentAGI, PentestGPT, PentesterFlow, Nebula, Ethiack, and specialized security LLMs like CyberStrike-OffSec-35B, alongside commercial solutions including NodeZero, Pentera, RidgeBot, and Hadrian, areFortigateSnifferThe operation included a custom Golang tool (FortiGateSniffer) that monitored up to 24 protocols, a distributed GPU password-cracking cluster (Hashtopolis), and a Telegram bot for coordination.Hackian9. Ethiack / Hackian — Commercial Agentic PentestingHashtopolisThe operation included a custom Golang tool (FortiGateSniffer) that monitored up to 24 protocols, a distributed GPU password-cracking cluster (Hashtopolis), and a Telegram bot for coordination.NebulaResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.PentAGIResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.PentesterFlowand vulnerability research, platforms such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, PentesterFlow, Nebula, Ethiack, and specialized security LLMs like CyberStrike-OffSec-35B, alongside commercialPentestGPTResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.Recon Skills11. Recon Skills — Structured Offensive-Security Knowledge BaseStrixResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.T3MP3STResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.XBOWResecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.
Countries
Industries
Emergency ServicesTargets: At least 17 organizations across healthcare, emergency services, government, and religious institutions.GovernmentTargets: At least 17 organizations across healthcare, emergency services, government, and religious institutions.HealthcareTargets: At least 17 organizations across healthcare, emergency services, government, and religious institutions.Religious institutionsTargets: At least 17 organizations across healthcare, emergency services, government, and religious institutions.