Artificial Intelligence
Pentera pitches deterministic harness for agentic pentesting
The article argued that agentic pentesting depends less on the model that chooses attacks than on the harness that governs execution, records results and turns findings into proof, then tied that idea to Pentera Apps.
- The article said an AI pentesting agent can choose attacks, but the harness around it decides what runs safely and what evidence is produced.
- It said OWASP’s 2026 guidance routes privileged actions through a deterministic policy engine and treats prompt injection as the top risk for LLM applications.
- It said Google stopped taking product vulnerability reports to its open-source bug bounty programme in October 2026 after a rise in automated submissions, most of which it said were invalid.
- Pentera said Pentera Apps pairs an AI that selects tests with deterministic controls that log actions, allow pauses and can stop tests at any point.
- The piece said the product produces replayable exploit scripts, CVSS 3.1 scores and CWE mappings, and can rerun the same attack after a fix.
Assaf Regev of Pentera wrote that an AppSec team can aim an AI agent at its own web applications with little setup, but that the surrounding controls determine whether the work is safe and useful. He pointed to the intrusion at Hugging Face that OpenAI disclosed in July as an example of what can happen when containment fails.
The article broke the problem into scope, credentials, prompt injection and proof. It said OWASP’s 2026 guidance places privileged actions inside a deterministic policy engine, and it cited Google’s October 2026 decision to stop taking product vulnerability reports to its open-source bug bounty programme after many automated submissions.
It also said prompt injection can enter through page content, hidden fields, metadata and comments, and that no reliable prevention exists today. The piece said the response is to constrain each action tightly and require human review for some steps, while noting OWASP’s warning that approval fatigue can weaken judgement at scale.
The final section moved to Pentera Apps, which Pentera said separates model reasoning from execution. The company said the system logs every action, can pause or stop tests, redacts most data before sending it to an LLM, keeps data in the customer’s region and returns replayable exploit scripts with scoring and mapping details.
Named in this story
People
- Assaf Regev
- Pentera’s AVP Product Marketing and the article’s contributor
Companies
- Pentera
- the company behind Pentera Apps
- stopped accepting product vulnerability reports to its open-source bug bounty programme in October 2026
- OpenAI
- disclosed the July intrusion at Hugging Face
- Hugging Face
- the company whose intrusion OpenAI disclosed in July
Organisations
- OWASP
- issued 2026 guidance on scoped actions and prompt injection
Products and systems
- Pentera Apps
- the agentic web app pentesting product described in the piece
How the source tells it
The piece reads like a technical explainer wrapped in a product pitch, with measured risk discussion, some security urgency and repeated reassurance about Pentera’s approach.
- vendor boosterism it shifts into first-person product claims and presents Pentera Apps as the answer to the problem it has just described
- urgency it uses top-risk claims and warnings about approval fatigue to press the need for tight controls
- reassurance it counters the risk discussion with claims about deterministic control, logging, replayable proof and data-handling safeguards