How to Build an AI Agent for Pentesting Without Turning It Into a Black Box
Most security specialists begin using language models as advanced reference tools. A person describes the task, receives a hypothesis, command or code snippet, verifies the answer and independently decides the next action. In this mode the boundary of responsibility remains clear: the model proposes while the specialist evaluates and executes. Even if the response proves incorrect, it is usually possible to reconstruct the workflow and identify the exact step where the error appeared.
With an AI agent the scheme changes. The agent receives a goal, plans several steps, invokes tools, analyzes their output, stores results in memory and continues work with the new context. This approach automates not only individual commands but entire sequences of actions. However, together with speed comes risk: the specialist sees only the final answer and may not understand which hypotheses were tested, which commands were executed and why the agent selected that particular path. At this point the useful assistant turns into a black box.
Agent is not a long prompt
An ordinary LLM answers a request. An agent must independently repeat the working cycle: understand the current state of the task, choose the next step, call the appropriate tool, interpret the result and adjust the plan. It is precisely the ability to act across multiple stages that distinguishes an agent from a chat in which every continuation is initiated by a human.
Define boundaries first, then connect tools
The formulation “find vulnerabilities” is too broad. It does not clarify which targets may be examined, which methods are permitted, when to stop and what constitutes confirmed evidence. A human can restore missing context from a contract, program rules or personal experience. An agent sees only the data and instructions provided to it.
Before launch it is necessary to describe the operational contour:
- goal and expected result;
- permitted nodes, applications and types of checks;
- actions that must not be performed;
- available tools and limits of their use;
- criteria for confirming a discovered issue;
- conditions for stopping;
- cases when human consultation is required;
- format of the log and final report.
Restrictions should be technical rather than purely textual. A prohibition in the system instruction is useful but does not by itself block command execution. The most reliable approach combines instructions with mechanical controls that limit commands, parameters, directories, addresses and available tools at the execution environment level.
Build a minimal working cycle
The first prototype should not attempt to do everything. The more tools and roles appear simultaneously, the harder it becomes to determine the cause of failure. For the start it is enough to implement a short, easily observable and repeatable process that includes obtaining a concrete technical task, formulating one testable hypothesis, selecting an allowed tool, proposing launch parameters, obtaining confirmation for critical actions, executing the check, saving source data and result, explaining what changed in the understanding of the task and proposing the next step.
Do not force the model to reinvent the process
If the agent must be told the working procedure from scratch every time, results will vary more widely and configuration will take longer. Repeatable instructions are best packaged as separate skills that describe the purpose of a tool, allowable parameters, verification sequence, signs of successful outcome and typical errors.
Record the path, not only the final answer
The final report does not reveal the quality of the process. An agent may reach the correct result after systematic hypothesis testing or may obtain it accidentally after dozens of irrelevant actions. From the outside both variants look identical. To distinguish methodology from coincidence it is necessary to preserve the trajectory of work, including the original goal and constraints, the agent’s hypotheses, chosen tools, parameters sent, raw command output, result interpretation, reasons for plan changes, confirmation requests, manual interventions by the specialist and final evidence.
Limit actions technically
The most dangerous configuration is an agent with broad rights and a vague goal. If it has access to a shell, file system, network tools and credentials, a textual prohibition is insufficient. A safe contour should include a separate agent account, minimal file and service rights, an allowlist of tools and operations, parameter validation before execution, prohibition of destructive commands, an isolated execution environment, request-rate limits, confirmation of critical operations and complete logging of calls.
Test refusal as thoroughly as success
A demonstration in which the agent finds a flag confirms only one scenario. Before independent operation the agent must be tested in conditions where the correct result is to stop. A minimal set of negative tests should include attempts to leave the permitted scope, requests for a forbidden tool, access to an unavailable file or secret, malicious instructions in external content, attempts to bypass operation confirmation, repetition of one unsuccessful action in a loop, contradictions between the original goal and new data, and generation of a report without sufficient evidence.
Leave high-error-cost decisions to the specialist
Human-in-the-loop does not mean the human manually controls every command. The specialist’s role is to set boundaries and make decisions where automatic choice is insufficiently reliable. The specialist must intervene if the agent loses the goal, begins to repeat itself, cannot explain the next step, proposes expanding the scope or draws a conclusion that cannot be confirmed by saved data.
AI Pentesting Challenge: from agent assembly to results analysis
CyberED and Standoff Hackbase are conducting a practical AI pentesting challenge. Participation requires basic understanding of penetration testing, web vulnerabilities and command-line work. On 10 September at 19:30 MSK an opening webinar will be held. An expert will assemble a minimal agent live and bring it to launch on the training range. From 10 to 17 September participants will asynchronously configure and improve their agents, search for and exploit vulnerabilities in dynamic tasks on the shared Standoff Hackbase range and monitor the public ranking. On 17 September the expert will demonstrate their own run with an agent, analyze working strategies, dead-end approaches and typical agent-management errors, then summarize the challenge results.
Related articles
AI Agents Remember Everything: Privacy Risks of Persistent Memory
AI agents are advanced models capable of calling external and internal tools while cycling through complex tasks. They retain extensive memory of user actions, model responses, tool usage, and all related interactions. This design allows agents to learn user preferences such as specific formatting rules or language choices after a single explanation. Personalization improves efficiency but creates detailed profiles of communication styles, habits, and personal information. The stored data raises questions about what a personal AI assistant might remember and with whom that information could be shared. The article from Selectel highlights how convenience in AI agents directly conflicts with user privacy expectations.
AI Detection Agents Shift Cybersecurity from Alerts to Autonomous Investigations
AI-powered detection agents are redefining how organizations identify and respond to cyber threats by moving beyond simple signature matching and alert generation. Instead of forwarding isolated events to human teams, these agents now perform initial investigations themselves, correlating telemetry from multiple sources and reconstructing attack chains before escalating any incident. The technology has progressed from theoretical discussions to active budget conversations, forcing security teams to evaluate how much triage work can be handled autonomously. Traditional monitoring systems deliver chronological events and leave analysts to connect the dots manually, while the new agents handle correlation, timeline verification, and scope assessment upfront. Attack automation has increased the urgency, as malicious actions can now produce effects faster than human analysis can complete. The agents collect artifacts, review asset history, check for repeated behavior, and determine the real impact, redistributing analyst workload without removing the need for human judgment on business impact and response decisions.
Local LLM Contract Analyzer Hit by Prompt Injection Despite Anti-Leak Instructions
A developer running a local nine-billion-parameter LLM for contract risk analysis discovered two suspicious log entries overnight. One contained repetitive garbage text, while the second embedded a classic prompt injection inside what appeared to be a legitimate contract: an instruction to ignore prior rules and output the full system prompt. The model partially complied by generating a fabricated risk entry titled SYSTEM PROMPT LEAK that described its own instructions, all while respecting the required JSON schema. Multiple defense layers were implemented, including input validation, regex-based injection phrase detection, an explicit rule inside the system prompt, and an output filter that replaces suspected leaks. Testing later revealed that the model still followed a hidden instruction to silently omit a specific contract clause, demonstrating that prompt-level rules only shift probabilities rather than enforce hard boundaries. The incident highlights that any document fed to an LLM must be treated as potentially hostile input.
GPT-6 Astra Shows Strong Tool Use and Math Results but Trails in Text Quality Tests
OpenAI released GPT-6 Astra on 3 September 2026 with capabilities for long-horizon tasks involving code, documents and external tools. Independent benchmarks from Artificial Analysis, Epoch AI and others reveal a mixed picture: the model leads in Epoch Capabilities Index and certain coding agent tests yet falls behind Claude Fable 5.1 in text generation and some professional document tasks. Astra solved two previously open problems on FrontierMath Erdős and reached 99.9 percent on ARC-AGI-3 when paired with a state-preserving adapter. The model was rated Critical for cyber capabilities after scoring 100 percent on ExploitBench and discovering two previously unknown vulnerabilities. Pricing starts at $10 per million input tokens, 2.5 times higher than GPT-5.6 Sol, while real-world costs vary sharply depending on task length and retries.