AppSec teams can point AI agents at web applications with minimal setup, but safe automated pentesting requires a robust engineering harness.
Learn how routing requests through a deterministic policy engine enforces scope, manages credentials, and controls human-in-the-loop checkpoints.
This control system, which acts as a protective shield around artificial intelligence, is what determines whether security tests will be safe and useful.
How are program movements controlled?
During an automated test, the program makes decisions about where to send requests. Since an application may connect to various services, it needs consistent code that checks each movement before it leaves the system, so that the test does not go out of bounds.
Additionally, as the program searches for vulnerabilities, it may find passwords or digital access keys. The control system is what decides which of these are allowed to be used and when a human must intervene.
READ ALSO
OpenAI programs disabled their control systems in internal tests
The risk of deception
One of the biggest problems is that the AI reads text and data within the websites it monitors. Anyone could leave a message containing hidden instructions capable of tricking the program.
Experts note that there is still no reliable way to completely prevent this deception, which makes it a top challenge for such applications.
The interruption in Google problem reports
In October 2026, Google stopped accepting reports of security issues in its open source program. The decision came after a large increase in automated submissions, most of which were invalid.
For a report to be valuable, the program must test the attack, record exactly what it achieved, and package the result so that developers can repeat it within specified limits.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
