Research area · Offensive security Agentic
Agentic Offensive Security: Autonomy requires verifiability and control
AI agents are changing offensive security testing: they map attack surfaces, crawl applications, and test vulnerabilities in parallel. Vami Research examines the conditions under which this is responsible — with a scope check before every action, graduated approvals, and traceable evidence — and connects this with pentesting, red teaming, and AI red teaming.
- Agentic pentests
- Scope enforcement
- OWASP APTS
- MCP pentests
- AI red teaming
- TTP-based red teaming
- EASM
- Deep Dives
- 13
- Whitepapers
- 4
- Solutions
- 1
When agents are allowed to attack: scope, oversight, and proof
Offensive testing is becoming agentic. AI-driven pentest platforms increasingly execute attack chains on their own: depending on the autonomy level, they suggest steps, plan them for approval, or execute them themselves under supervision. For clients, this shifts the question. What matters is not only what was found, but how the platform behaved: whether it stayed within the authorized scope, who approved which action, and whether every finding is backed by evidence.
The OWASP Autonomous Penetration Testing Standard (APTS) describes exactly these platform properties: 173 requirements in eight domains, from Scope Enforcement through Human Oversight and Manipulation Resistance to Reporting, plus three compliance tiers and four autonomy levels. It is available as version 0.1.0 and does not replace a testing methodology. If the agent infrastructure itself is the target, an MCP pentest examines the interplay of server, client or host, and gateway, using the OWASP MCP Top 10 (v0.1, Beta) as a structuring framework, not as a testing standard.
VamiRedteam, the agentic penetration testing platform, follows the principle that control remains with the client: three AI agents — Recon, Smart Crawler, and Pentester — test web applications, APIs, hosts, and networks exclusively within the authorized scope, and every action is checked before execution and logged. The classic disciplines remain alongside: pentesting, red teaming along MITRE ATT&CK, EASM, physical and IoT pentests, bug bounty, audits, and M&A due diligence.
Open questions in practice
- 01
How can you tell whether an autonomous pentest platform reliably stays within the authorized scope?
Our approach
By its behavior during execution. OWASP APTS requires scope boundaries to be enforced technically rather than merely contractually, along with a working kill switch, impact classification per action, and signed, platform-isolated audit trails. In procurement, a tier self-declaration with concrete answers on scope enforcement and the kill switch is advisable; kill switch tests belong in every engagement.
- 02
How do you test MCP servers when tools are model-controlled and descriptions act as instructions?
Our approach
As an interplay of server, client or host, and gateway rather than as a single endpoint. We hash every tool definition as a baseline, test for rug pulls and shadowing, and introduce harmless markers into tool responses, documents, or tickets to see whether the agent treats them as instructions. We substantiate configuration findings deterministically, and behavioral findings with repetitions, hit rate, model, and client.
- 03
What distinguishes AI red teaming from a classic penetration test?
Our approach
A pentest shows which vulnerabilities a defined system has. AI red teaming tests the behavior of the AI system itself: jailbreaks, direct and indirect prompt injection, data extraction, and tool misuse. The anchors are the OWASP GenAI Red Teaming Guide and NIST AI 100-2; since August 2, 2025, the AI Act has required adversarial testing from providers of general-purpose AI models with systemic risk.
- 04
How do agentic tests and classic offensive disciplines fit together?
Our approach
They answer different questions and do not replace one another. EASM finds unknown assets, the pentest proves exploitability, red teaming measures detection and response, and audits check against a defined yardstick. Agentic tests allow more frequent testing when attack surfaces change with every release. Physical and IoT pentests cover buildings and hardware.
Key takeaways
- 01
What matters is the autonomy needed, not the autonomy possible
OWASP APTS couples autonomy to evidence: from L1, in which the platform only makes suggestions, to L4, end-to-end autonomous operation, the assurance requirements rise; L4 is only defensible with Tier 3 evidence. In practice, L2, in which a human approves every step, is sufficient for many organizations.
Source: OWASP APTS
- 02
Classic test cases cover MCP risks only in part
MCP breaks the assumption of deterministic behavior: according to the specification, tools are model-controlled, operate with delegated user permissions, and open up arbitrary data access and execution paths. A study of 1,899 open-source MCP servers found eight vulnerability classes, only three of which overlap with classic software vulnerabilities. MCP pentests need test cases of their own.
Source: MCP Pentesting
- 03
Evolving AI systems need repeated testing
An attack on a language model may only succeed after several attempts, and model updates, new system prompts, tools, and data sources continually shift the risk landscape. AI red teaming therefore combines automated tests for breadth with manual, context-specific attack chains and regression tests for every relevant change.
Source: AI Red Teaming
- 04
Red teaming measures the defense, not the number of findings
What is meaningful is the time to detection, the time to containment, and which of the tactics and techniques exercised triggered any alerts at all. Mapping the attacker's actions to MITRE ATT&CK makes detection gaps systematically visible — a robust statement instead of a snapshot.
Source: Red Teaming
How we work
We test offensively and document in such a way that every statement can be verified: scope defined in writing and technically, autonomy deliberately chosen, evidence per finding, and, for behavioral findings, the hit rate.
Agentic pentests
VamiRedteam checks every agent action against the authorized targets before execution, with approval for each command on request.
MCP pentests
Test server, client, and gateway along the OWASP MCP Top 10 (v0.1, Beta): tool definitions via baseline hash, markers in third-party content, reconstruction from the logs.
AI red teaming
Jailbreaks, direct and indirect prompt injection, data extraction, and tool misuse along the OWASP GenAI Red Teaming Guide and NIST AI 100-2.
TTP-based red teaming
Attack simulation along MITRE ATT&CK with agreed objectives, measurement of detection and containment, and purple teaming as a learning loop.
Attack surface from outside and on site
EASM for unknown assets and shadow IT; physical and IoT pentests where buildings, hardware, and radio are part of the attack surface.
APTS gap assessment
Assess autonomous pentest platforms against the eight APTS domains, including vendor due diligence and regulatory mapping.
How to get started
- 1Define scope and autonomyAgree on targets, exclusions, test windows, and emergency contacts in writing, and define for each target which steps require approval.
- 2Test and substantiateExploit vulnerabilities in a controlled manner, document every finding with evidence, reproduction steps, and proof, and log every step.
- 3Assess and retestPrioritize findings, support remediation, and verify fixes with a retest, as evidence for audits, NIS2, and DORA.
Deep dives, whitepapers, and analyses
Deep Dives 13
Whitepapers 4
More pages
From research area to implementation
Services
Related research areas
Autonomous testing — with scope, oversight, and proof?
In an initial consultation, we clarify scope, oversight, and the regulatory framework — from classic pentests and AI red teaming to agentic tests with VamiRedteam.