The hype around autonomous pentesting, and where the coverage actually is

Most autonomous pentesting systems land on one of two architectures: a fixed pool of specialist agents (ex. one for XSS, one for SQLi..) or a single agent that recursively spawns copies of itself. In practice, both fail for the same reason: neither controls breadth. The fixed pool treats every surface as equally important and never goes deep where it should. Pure recursion collapses into depth-first search, chases the first promising lead until the budget is gone, gets trapped by honeypots, and leaves half the application untouched. The run looks like a "pentest". But the coverage isn't there... In our Research Team, we modeled an engagement instead as an explore/exploit search problem. We considered coverage not a phase at the start of the scan, but an adversarial control loop running continuously. What we mean by that is a dedicated coverage agent, with no exploitation tools of its own, maps the attack surface, identifies what remains untested, and pushes work back to an orchestrator that protects breadth while spawning specialized agents only where they're needed. This talk goes into the harness internals that we've seen to make that work: - persona-isolated browser contexts, so the system can act as several users at the same time. This is necessary to find BOLA, IDOR, and cross-tenant privilege escalation. - an independent reporter agent that reproduces every candidate finding on the live target, so we kill hallucinated vulnerabilities before they reach the user. - recursive delegation, but with depth governance. - a capability and skill layer that keeps each agent’s context small and scoped. We present benchmarks against public AI pentest tools and a raw frontier-model baseline, with methodology laid out in full. Then we want to close on what's still unsolved: In particular: how do you evaluate a system where agents spawn agents, and where you can no longer test a single node, only the whole trace? And can the best specialized agents be persisted, pruned, and reused across engagements, so the system compounds over time?