Aikido Launches Agentic Penetration Testing for Android Apps
Summary
Aikido announced Android pentests using agents to test an APK and its backend together. Source code is currently required; findings are reported after exploit confirmation, with reproduction steps and retesting. The vendor says scope controls and safety checks are built
Key points
- Aikido says its agents install and test an Android APK alongside the backend API in one assessment.
- Android testing is currently white-box only and requires the app’s source code, an APK, and test-user credentials.
- The vendor says findings are reported only after successful exploitation and confirmation, with reproduction steps including exact ADB commands.
- The service provides agent traces, a recon report, and an attack plan; AutoFix can open a pull request with a suggested fix.
- Retesting requires rebuilding the APK after a fix and uploading the updated build.
- Uploaded builds must have certificate pinning, root and emulator detection, and RASP disabled, according to the article.
- Aikido says testing is scoped through a proxy, starts non-destructively, and can pause automatically; claims about matching or exceeding human coverage are vendor claims.
Article Details
- Event Type
- Product launch: Aikido introduced agentic penetration testing for Android apps, testing the app and its backend API in one assessment.
- Impact
- The service is available now and requires an APK, Android source code, and test users; Android testing is white-box only. It reports findings after confirming they are exploitable and provides reproduction steps and remediation support, including AutoFix and retesting. No security incident or victim impact is reported.
Vendors
Products
Aikido PentestingAndroid pentests also come with the Aikido pentesting features you already know, like AutoFix and included retests. That way, the app, its backend, the findings, the fixes, and the retests stay in one place. Run AutoFixAndroidTL;DR: Aikido now pentests Android apps. The same agents that test your web apps and APIs can now work through your APK, log into the app, and reason through it, alongside the backend it talks to, in a singleAutofixit talks to, in a single assessment. Findings come back with reproduction steps and are ready for an AutoFix, the same as any other Aikido pentest.Code Security AuditIf you've used Code Security Audit to reason through mobile source before there's a live build, you’re already familiar with this part. The agents use the running app and its backend together, and confirm what's