Introducing Agentic Pentesting

Today, we’re introducing Agentic Pentesting: autonomous agents that attack your running application like a team of elite security researchers.

Agentic Pentesting is uniquely integrated with code security, enabling security teams to:

• Find complex vulnerabilities in running applications, with or without source code access
• Confirm whether findings from code scans and other sources (like bug bounty programs) can be exploited at runtime
• Replay an attack after remediation to verify that the vulnerability has been fixed

Pentesting has traditionally been siloed from the security stack

A traditional pentest captures how an application behaves at a moment in time. A tester explores the application, identifies vulnerabilities, and delivers a report with findings and reproduction steps.

The result is a report, but this is where the pentest usually ends. Security teams must translate each finding into engineering work and rebuild the context needed to take it from triage through remediation.

This workflow was designed for a pre-AI world. As AI makes vulnerability discovery and exploitation more accessible, systems must help defenders manage findings over time and resolve them just as quickly.

depthfirst Agentic Pentesting connects deep application context to runtime behavior

In addition to black and grey-box testing, we integrated Agentic Pentesting with code security in the depthfirst platform, connecting runtime testing to the context and workflows teams already use to investigate and remediate findings.

When source code is connected, depthfirst agents can draw upon the continuous context depthfirst already knows about your code, prior findings, pull requests, and threat model to test the most promising attack paths.

Security teams can run pentests on demand as part of their CI/CD pipeline. Agents authenticate to a target application and interact with it through its interfaces and APIs. As they explore, agents learn how the application behaves, retain evidence between tests, and use it to form new hypotheses about possible attack paths.

“

Agentic Pentesting is surprisingly good: it even found a vulnerability in a feature that had been part of Supabase for two years and had already gone through multiple rounds of pentesting.

Find complex vulnerabilities across your application

Many serious vulnerabilities emerge from assumptions between services or business rules that no single component enforces. depthfirst uses code context and live interaction to identify those gaps, then tests them at runtime by probing the assumptions that connect each step of a workflow.

Consider an application that allows each customer to redeem a promotional code once. A depthfirst agent notices that the redemption handler tracks only the promotion’s total usage and never records who has redeemed it, so the tracker cannot tell whether the current user has already used the code.

The missing check gives depthfirst a concrete hypothesis to test. An agent redeems the same code twice and confirms that both credits persist in the account.

Both requests appear legitimate, yet together they violate the one-redemption-per-user rule. With no global cap, an attacker could repeat the process to generate potentially unlimited promotional credit.

In another recent test, our agentic pentester extracted an AI assistant’s system prompt through a multi-step conversation. After direct requests were refused, it adapted to the replies, assumed different roles, and reframed its requests as routine validation tasks. The assistant eventually disclosed instructions that were intended to remain hidden.

Validating findings in the running application

depthfirst’s code scanner identifies potential vulnerabilities and evaluates whether exploitation is plausible with code evidence. It traces the path from attacker-controlled input to the vulnerable operation, while the application’s threat model helps establish criticality.

This analysis removes many non-issues from the security team’s queue, but some findings depend on runtime conditions that source code cannot settle. A targeted test can determine whether the attack succeeds in production.

For example, consider a deployment platform that lets users import a Git repository by URL. A code scanner may see that URL passed to git clone and flag SSRF: the worker might be tricked into calling an internal service instead of GitHub.

From the code, this finding seems exploitable, but the scanner can’t tell what that worker can actually reach in the production environment. Runtime testing reveals that while normal imports work, an egress proxy blocks internal and unapproved hosts. The code looks vulnerable, but the running application isn’t exploitable.

“

Agentic Pentesting allows us to reproduce code findings to ensure they’re exploitable. Sharing these results with the exploit path with developers helps us get to remediation quicker.

Third-party vulnerability reports can also enter the same process. For example, our Bug Bounty Verification first checks for duplicates, then uses the report’s claim as the hypothesis for a targeted Agentic Pentesting run. The resulting evidence shows whether the findings is exploitable.

Fixing vulnerabilities and verifying repairs

Because depthfirst understands how the application works, it can recommend a fix that fits its existing implementation and threat model. Engineers or agents can review the proposed change alongside the evidence needed to reproduce the attack, then deploy it through their development process.

Once the updated code is running, teams can use Agentic Pentesting to replay the original attack. If the exploit is prevented, the retest provides evidence that the repair works in production. If it still succeeds, the finding remains open for further investigation.

Available on depthfirst

With Agentic Pentesting, teams can finally break the siloes between code context and runtime validation to remediate vulnerabilities more quickly, easily, and confidently than ever before.

It is now available in depthfirst. Request a demo to try it now.