Most “AI pentesting” right now is theatre.
Cool demos. Zero outcomes.
So we built an OpenClaw agent, wired it with real skills + guardrails, and let it loose against:
• Production Active Directory
• A live web app
Result:
- 3 days of AD recon → 3 hours
- 23 valid findings in AD
- 52 valid findings in Web app
- Valid attack paths toward DA
We’ve open-sourced how we did it, example skills, infra, and the agent persona:
https://t.co/4xfVpARTyc
This is what AI pentesting looks like when it’s not a demo.
We let openclaw loose in our prod AD network..
Relevant persona, skill, architecture and report made public.
Check out how we achieved this in the Sophos blog post below.
https://t.co/VwitSEmArx
If your interested in the methodology behind penetration testing AI ecosystems, check out my latest blog post!
Deep dives on these methodologies to follow soon!
#cybersecurity#ai#hacking#ethicalhacking#offensivesecurity
https://t.co/osZ59Q19Sb
Most companies think the risk with AI is the model. Its not....
If an attacker can influence the model, they can influence the systems behind it!
My latest post on how we test AI Ecosystems and use LLM's to pivot to real infra. Check it out below.
https://t.co/osZ59Q19Sb
Just came across this on good old LinkedIn, by a senior security program manager.. do these people really believe we run ZAP and metasploit during pentests? 🤣🤦🏻♂️ mindblown
With all these AI pentesting bots being posted recently, I decided to put my two cents into why we are not ready for fully autonomous pentesting with AI yet.
Im case you missed it, read it on my blog here:
#ai#Pentesting#CyberSecurity
https://t.co/0juLZoXdXb
@JustL22866 Yeah agreed there, the legal discussions would be a requirement. Data wise I didn't touch on in this post but this would certainly be something to consider if you're planning on using any of the frontier models like Claude, GPT etc.
I decided to start a blog for some hacker ramblings and insights, and what better way to start than to discuss why AI is not yet ready for end-to-end pentesting.
Keen on getting people talking about this subject, let me know your thoughts on this!
https://t.co/0juLZoXdXb
@x25princess 100% would agree. Recently had an OKR to create an AI based tooling to assist with adversarial attacks / penetration testing. Given the hallucinations etc in LLM's, there ain't no way I'm throwing any AI based tool at a live env.