AI pentesting
14 posts
AI pentesting
AI pentesting: what it is, and what it can actually find
Scanner with a chatbot
A real AI pentest
Login
Stops at the login page
Authenticates and tests behind it
Identities
Tests as one user
Holds several at once
Findings
A list it never reproduced
Every one reproduced before it files
13 min read
AI pentesting
What an external penetration test is and how one is actually run
Starts from
Asks
You get back
External pentest
The public internet, no access
Can an attacker get in at all
A demonstrated way in
Internal pentest
An assumed foothold
How far they get once inside
A lateral-movement path
Vulnerability scan
An asset list you supply
Is any known issue present
15 min read
Case Study
How Amp got its SOC 2 type II pentest evidence in hours
Amp is building the AI hiring team for frontline employers. Compliance was in the product from day one, which meant a pentest in year one. Here is how they scoped it, ran it in hours with Escape, and made sure they're ready for their SOC 2 Type II audit.
7 min read
AI pentesting
Modern AI-powered Pentesting Tools In-Depth benchmark
If you're evaluating AI for offensive security right now, you're weighing two questions at once. The first: why not skip the tooling and point a frontier model at your apps yourself? The second: among the AI pentesting tools you could actually buy, which one earns the
15 min read
AI pentesting
Two Critical Vulnerabilities, One AI Pentester: How Cascade Found an Unauthenticated RCE and Walked Around the WAF
TL;DR
We pointed Cascade, Escape's AI pentesting solution, at a single Spring + JSP customer portal. It came back with two findings that are typically difficult for traditional Dynamic Application Security Testing (DAST) scanners to detect:
* Unauthenticated RCE via SpEL injection. A ref request parameter was dropped, unsanitized,
11 min read
AI pentesting
Introducing Cascade: the multi-agent penetration testing that becomes an expert in your business
Escape CASCADE allows you to run deep, human-grade assessments across your whole attack surface, proves every finding with a working exploit, and gets more expert in your business with every engagement.
15 min read
Agentic Pentesting
How Escape AI Pentesting Exploited SSRF in LiteLLM
At Escape, we routinely test the AI infrastructure that teams deploy inside their cloud environments.
LLM gateways, RAG pipelines, model proxies: these are services that make outbound HTTP requests by design, which makes them natural targets for SSRF.
When we looked at LiteLLM, we found three confirmed SSRF sinks, a
9 min read
Pentesting
Best 8 AI Pentesting Tools in 2026
Explore the best AI pentesting tools in 2026. Learn how modern pentesting solutions detect business logic flaws and scale continuous security testing, so security teams can replace manual pentests with faster, more accurate coverage. Updated: August 2026
26 min read