Building an AI Pentest Agent That Knows When to Stop
Most of a VAPT engagement is repetitive: enumerate, scan, triage, re-check, write it up. I built an in-house agent at CRIS InfoTech to take that grind off the team. The interesting part wasn't getting the LLM to run tools — it was teaching it where its job ends.
The loop
The agent works in small steps. It reads the current state of the target, picks the next tool, runs it, and summarises what changed. That summary — not the raw output — is what goes back into the model, which keeps context small and decisions focused.
- Recon: subdomains, ports, tech fingerprinting
- Scanning: Nuclei templates and targeted Burp checks
- Validation: SQLMap / ffuf only against confirmed candidates
- Reporting: draft findings with CVSS, evidence and fixes
Scope is enforced in code, not in the prompt
The allowed hosts, ports and time windows live in a config file the tool wrapper checks before every call. If the model asks for something out of scope, the wrapper refuses — the model never gets the chance to talk itself into it.
Human-in-the-loop for anything that changes state
Reading is automatic. Anything that could change the target — exploitation, brute force, file writes — pauses and asks a tester to approve. That one rule is what makes the agent safe to use on client systems under real rules of engagement.
False positives are the real work
Scanners are noisy. The biggest win was having the model re-check each candidate with a second, different technique before it reaches the report queue. Anything it cannot reproduce is marked unconfirmed for a human to look at.
What I'd tell anyone building one
Start with reporting, not exploitation. A model that turns messy evidence into a clean, CVSS-scored draft saves hours on day one — and it never touches the target.
Tools mentioned
An AI pentest agent is only as good as its guardrails. Put scope in code, keep humans on every state-changing step, and let the model do the boring parts brilliantly.