Agentic AI-Assisted Penetration Testing: AI Scale. Human Precision

Kroll’s Solution

Kroll applied an agentic AI-assisted penetration testing harness within a consultant-led assessment. The harness was designed to augment established penetration testing practices rather than replace professional judgment.

The solution was model-agnostic, allowing the testing team to use appropriate frontier models as capabilities evolved. Agents were provided with a powerful set of penetration testing tools through the Model Context Protocol, enabling them access to the same set of tools used by human penetration testers.

Kroll is part of the verification programs offered by frontier AI labs, which allows it access to models with reduced guardrails to perform authorized penetration testing. Kroll’s agentic harness is not effective without access to these models because the standard guardrails consistently shut down our tests.

Integration with web security tool Burp Suite Professional allowed experienced consultants to monitor agent activity, examine AI-generated test cases, extend coverage and validate potential findings. This human oversight was essential to ensuring that Kroll’s professional consultants remained in control of the assessment and providing assurance about conclusions and the coverage.

Customized skill files aligned agent behavior with Kroll’s penetration testing methodology. The harness can also incorporate knowledge from previous assessments, allowing it to revisit known conditions, discover attack paths and test whether previously identified weaknesses appeared elsewhere.

All activity was logged to support review and auditability. This created a record of the agents’ actions and enabled consultants to examine how potential findings had been generated.

The resulting operating model combined the scale and persistence of AI-assisted testing with the contextual understanding, judgment and accountability of experienced penetration testers.

Representative Findings

Multi-Factor Authentication Bypass

The assessment identified a medium-risk vulnerability that could allow certain users to bypass a required multi-factor authentication step.

Exploitation depended on a narrow combination of circumstances. A specific HTTP POST parameter, one of many parameters included in the request, had to be present but empty. The target account also had to meet a particular type and configuration.

In the AI-assisted approach, a broader combination of practical parameters and account conditions than would typically be practical within a time-constrained manual workflow, were tested. The testing also identified an indication that the relevant parameter warranted closer investigation.

The finding illustrates how agentic AI can extend test coverage by persistently exploring more combinations than reasonable for a human consultant, while still requiring a consultant to verify the finding and its risk.

One-Click Cross-Site Scripting

Testing identified a high-risk cross-site scripting vulnerability that could be used to exfiltrate personally identifiable information (PII).

A related cross-site scripting vulnerability had been identified at another endpoint during previous penetration tests. The AI-assisted assessment discovered additional affected endpoints and developed a complex payload that leveraged another known design weakness to access PII data through a separate application endpoint.

The payload demonstrated how multiple weaknesses could be chained into a more consequential attack path. It included a cross-origin resource sharing bypass and used an external interaction service to demonstrate data exfiltration within the authorized test environment.

This proof of impact materially improved the quality of the risk demonstration. A conventional proof of concept showing only script execution would not have communicated the combined ramifications of the affected endpoints and application design as clearly.

Unauthenticated Endpoint Leading to Host Compromise

The infrastructure assessment identified an unauthenticated REST interface that exposed endpoints containing highly sensitive information, including credentials, logs and configuration data. The condition ultimately enabled complete compromise of the affected host and was rated a critical risk.

The application’s HTTP root returned an error page. A human analyst had performed brief endpoint enumeration unsuccessfully before moving on to other areas of the assessment.

The AI agent recognized clues in the error message indicating the presence of a less common open-source application. Drawing on knowledge of that application’s default and potentially sensitive interfaces, it identified the unauthenticated endpoint that led to the information and credential disclosures.

This finding demonstrated the value of an LLM’s inherent knowledge base to identify an unfamiliar technology. The agent was able to identify relevant test cases for a less common tool and direct attention to an attack path that initial manual enumeration had not revealed.