AI pentesting: test your own site, then write it up

An AI agent can run the broad, repeatable part of a pentest on a site you own: reconnaissance, mapping pages and API endpoints, probing each one against the access control it should enforce, and flagging what looks wrong. Scope, judgement about what matters and checking each lead stay with you.

The articles here cover the whole loop: how to pentest your own website step by step, how agentic testing works and where it stops, and how to write a lead up as a finding with severity, evidence and a fix. The worked examples run against CyberGym, a legal practice target.

HackerGPT features an AI agent that pentests your own website, shows you what is exposed, explains how to fix it, and teaches you hacking while it does.

Articles

• AI pentest vs manual pentest: what each one finds

  We sent 28 anonymous requests to one CyberGym target and then read the answers the slow way. What the breadth pass caught, what only context could decide, and what neither saw.

• Pentest report example: how to write up a finding

  A complete pentest finding written up step by step, from a real HackerGPT lead on CyberGym: title, CVSS 4.0 severity, reproduction, redacted evidence, impact, fix and retest, with the mistakes that make a report hard to act on.

• How to pentest your own website with an AI agent

  A practical walkthrough of testing your own web app with an AI agent: get permission and scope first, then recon, map, test and read the findings — with a worked run on CyberGym and a plain account of what an automated pass does not replace.

• AI-Driven Penetration Testing: The Shift from Automation to Agentic Workflows

  How an agentic AI pentest works (observe, decide, act, remember), traced through the real route table of CyberGym, and the three things an agent still misses: business logic, chained context and scope judgement.