Red September

Five Critical Mistakes That Cause AI Agents to Derail Automated Penetration Tests

An AI agent can independently explore an application, select attack techniques, run tools, and gather vulnerability evidence, yet practical experiments reveal persistent obstacles between capability and reliable execution. In a controlled test on a training web application, the agent was tasked with mapping the system, achieving exploitation, escaping a sandbox, escalating privileges, and completing a control action. While it ultimately succeeded, it repeatedly entered dead ends by pursuing inapplicable attack vectors, incorrectly declaring the target unavailable, and attempting technically valid but strategically pointless tasks. The core issue often stems not from insufficient model intelligence but from a lack of disciplined research methodology, including forming hypotheses, verifying them observably, and updating the system map before proceeding. Five specific errors are analyzed in detail, each illustrated with examples from the experiment and accompanied by recommended process rules such as building feedback channels for blind attacks and enforcing independent diagnostics before declaring infrastructure down. The article emphasizes that effective AI-assisted pentesting requires a structured cycle of context, hypothesis, safe action, observation, independent verification, and plan update rather than relying on a single powerful prompt or model.