Using an LLM for penetration testing: assistant, agent or scanner
An LLM can help with penetration testing of your own web app or API in three ways: as an assistant you prompt, as an agent that calls tools in a loop, or as a feature inside a scanner. It reads code, plans tests and drafts reports well. It fails at state across logins, proof of effect and invented endpoints. Require evidence for every finding, and test only with written authorization.
An LLM for penetration testing is a large language model used to help test a web application or API that you are allowed to test. A model can plan, read code and write reports. It cannot prove a finding without evidence. This page covers using an LLM to test your app. Testing an LLM app for prompt injection and similar risks is a different job, covered by AI application security assessments.
Authorization first
Test only systems you own or have written authorization to test. This applies to chat assistants and agents as much as to scanners. Use test accounts and test data.
How can you use an LLM in a pentest?#
There are three ways to use an LLM in a pentest, and they differ in who runs the tests and who checks the output.
| Way | What the LLM does | Who runs the requests | Main risk |
|---|---|---|---|
| Assistant (chat tool) | Answers prompts, drafts plans, scripts and reports | A person | Confident output that the person does not check |
| Agent (model plus tools) | Chooses the next request, calls tools, reads results in a loop | The agent, inside tool rules | Claims an effect it did not prove |
| Scanner feature | Ranks, groups or explains alerts from a fixed engine | The scanner | Hides what the engine did not test |
A tool named PentestGPT and similar projects sit in these categories. For a vendor-by-vendor view, see automated pentesting tools on pentestcompare.com, which Excession Labs publishes and discloses. The rest of this page covers the method.
What does an LLM do well in a web app test?#
An LLM does well where the work is reading, summarizing and drafting. Five tasks fit.
- Read a large JavaScript bundle and list the routes, API paths and feature flags it contains.
- Summarize an API description and mark the endpoints that take an object ID.
- Draft a test plan from a scope, mapped to the OWASP Web Security Testing Guide areas.
- Triage a long response log and point to the odd responses.
- Draft the report text once a person has confirmed the findings.
In each task the model proposes and a person or a tool verifies. The first task is a good example: the model reads the bundle, a script requests each route with test accounts, and the responses decide what is real.
Where does an LLM fail?#
An LLM fails where the answer depends on state, proof or facts that are not in the prompt. Each failure has a rule that fixes it.
| Failure | What goes wrong | Rule that fixes it |
|---|---|---|
| State across logins | The model forgets which account owns which record | Name accounts and record IDs in a table the tool keeps |
| Proof of effect | It says a request "succeeded" when nothing changed | Read the changed record back through a second session |
| Invented endpoints | It lists routes that the app does not have | Request each route and keep only real responses |
| Long plans | It loses the thread in a long engagement | A planner outside the model holds the task list |
| Refusals | The model declines some security prompts | Use an agent set up for authorized work, not workarounds |
| Rate limits and cost | A loop sends too many requests | Cap requests in tool rules |
Research supports the long-plan row. A December 2025 paper found that LLM agents struggle to keep coherent long-horizon plans, to reason through complex cases and to use specialized tools. It also found out-of-the-box Claude Code with Sonnet 4.5 stronger than earlier systems on its benchmark (arXiv 2512.11143). The authors' fix adds classical planning outside the model.
A second paper compared AI agents with ten professionals on a live network of about 8,000 hosts. Its best agent found 9 valid vulnerabilities with an 82% valid submission rate. The authors report higher false-positive rates for agents and trouble with GUI-based tasks (arXiv 2512.09882). Both studies used networks and lab targets, not your web app.
What evidence rule catches bad LLM output?#
The rule is: no finding without a request, a response and a proof of effect. A model can state a flaw with confidence and be wrong, so every claim must point at something you can check.
Sample check on a model's claim
This is a demonstration on a fictional app. No real customer system was tested.
A model says: "GET /v1/orders/48213 as shopper B returns shopper A's order, so the API has broken object-level authorization."
Before you accept it, run the controls.
| Check | Expected if the claim is true | Observed (invented) |
|---|---|---|
| Shopper B requests a nonexistent order ID | 404 | 404 |
| Anonymous request to the same order | 401 | 401 |
| Shopper B requests B's own order | 200, owner is B | 200, owner is B |
| Shopper A reads order 48213 and compares | Same note and total | Same note and total |
All four match, so the claim holds. If shopper B's answer had listed B as the owner, the claim would fail and be dropped.
This is the pattern behind insecure direct object references (WSTG-ATHZ-04). AI pentesting false positives shows a rejected claim step by step.
How do you keep authorization and data safe?#
Keep the test inside a written scope and keep customer data out of places it should not go. Four habits cover most risk.
- Get written authorization from the system owner before any request.
- Use accounts and records you created for the test, marked as test data.
- Remove tokens, cookies and personal data before you paste anything into a chat tool, and check the provider's data terms.
- Set tool rules for an agent: read-only requests run on their own, state-changing requests wait for approval, and out-of-scope hosts are blocked.
How agentic pentesting works describes tool rules in detail, and human-in-the-loop pentesting shows where approvals fit. We do not publish how any model is configured for our own agents.
When should you move from a chat tool to a managed test?#
Move when you need a result someone else will rely on. A chat assistant is a good fit for learning, planning and reading code. It is a poor fit for a report that a customer, auditor or board will read.
Signs you have outgrown it:
- You need findings with saved requests, responses and timestamps.
- The app has several roles, and the tests need to cover each one.
- A buyer asks who reviewed each finding.
- You cannot spare an engineer to check every model claim.
For a managed AI-assisted test, Excession Labs agrees the scope with you in writing, runs AI testing agents under tool rules, checks the evidence for each finding and writes the report. You can apply for a pilot or read the example assessment. For the wider picture, see what AI penetration testing is and automated penetration testing.
Questions
Can ChatGPT or Claude do a penetration test?
A chat assistant can help a tester plan, read code and draft a report. It cannot send requests, hold logins or prove an effect by itself. A person or a tool-using agent has to run the tests, and the output needs evidence before you trust it.
What is the best LLM for pentesting?
No model is best for every target. A December 2025 arXiv paper found that out-of-the-box Claude Code with Sonnet 4.5 outperformed prior systems on its benchmark, and also found weaknesses in long plans and tool use. Test any model on your own scope and judge it by evidence.
Can AI help with bug bounty hunting?
It can help read client-side code, summarize an API and draft a report. Read the program rules first: programs set their own scope and limits on automated tools. Test only in-scope assets, and check every claimed bug by hand before you submit.
Is it safe to paste a target's data into a public LLM?
Treat requests, tokens and customer data as sensitive. Do not paste them into a tool your authorization or contract does not allow. Use test accounts and test data, remove secrets first, and check where the provider stores the input.
Sources
- Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testing (arXiv 2512.09882) (checked 9 November 2026)
- Automated Penetration Testing with LLM Agents and Classical Planning (arXiv 2512.11143) (checked 9 November 2026)
- OWASP Web Security Testing Guide (stable release v4.2) (checked 9 November 2026)
- OWASP WSTG-ATHZ-04: Testing for Insecure Direct Object References (checked 9 November 2026)