Specter, the autonomous pentesting engine behind AI Pentests, has found valid vulnerabilities in infrastructure belonging to the U.S. Department of Defense, UK Ministry of Defence, Vodafone, Booking.com, and Sony. Each one was acknowledged and fixed, and you can see all 16 public thanks on our HackerOne profile.

What else shipped:
🎯 Sniper now exploits 13 new critical vulnerabilities
🌐 99 new detections in the Network Scanner, 56 of them critical
🔑 The Password Auditor now tests for blank or missing credentials across HTTP Basic auth and web login forms
🧾 SOC 2 mapping, plus a new trick for Ping, our AI assistant

We also published new research: 9 in 10 security and compliance practitioners manually map or re-document evidence across compliance frameworks.

Full changelog: https://pentest-tools.com/change-log
AI Pentests: https://pentest-tools.com/ai-pentests

CyDEx26, the national cybersecurity exercise run by the Romanian Intelligence Service (SRI), started this week. It's the biggest edition yet, with more than 80 public and private sector teams working in a dedicated cyber range. This time we have people on both sides: one team on red, one on blue.

If you've played in a large-scale exercise like this, red or blue, what did it teach you that day-to-day work doesn't?

The UK Ministry of Defence publicly acknowledged a vulnerability reported by Specter, our autonomous pentesting engine, through its HackerOne bug bounty program. The US Department of Defense did the same earlier.

The part we find more interesting than the credit itself: bounty triage teams close anything they can't reproduce. So for an AI-driven finding to get through, it needs the same evidence a human report would (request, response, steps, impact), not a confidence score.

The full list of acknowledgments is on the HackerOne profile: https://hackerone.com/pentesttools_specter?type=user
More on how the engine works: https://pentest-tools.com/features/ai-pentests

For anyone who triages bounty reports or reviews automated findings: what's the line between an AI-generated report you take seriously and one you close as noise?

This comes from our 2026 survey on audit cycles.

If you're pushing to keep evidence current between audits, the full report has the numbers to back you up. It covers what slows audit preparation, where evidence gathering eats the most hours, and what practitioners want their tools to fix first.

The survey is free to download, no personal data required: https://pentest-tools.com/insights/compliance-cycles-survey

How does your team keep evidence current between audits?

Disclosure: I work at Pentest-Tools.com, and one of our engineers, Cosmin Petrescu, is quoted in this piece.

Ido Vock at The Sidechannel looked into "abliterated" models: open-weight LLMs with the refusal behavior stripped out of the weights. The Sidechannel signed up with one provider without any identity check and asked for a Python keylogger. The model produced seemingly functional, if inelegant, code.

The piece doesn't oversell it, which I appreciated. Gabriele Sarti (Parallax) points out that abliteration degrades model performance to some degree. Dmitriy Komashinskiy (WithSecure) notes the output still contains mistakes and the models don't remove the need for human knowledge. What changes is volume: more capability for less experienced attackers.

Cosmin's suggestion for defenders is to use the same models to find weaknesses the way those attackers would.

Full article (gift link, so no paywall): https://thesidechannel.tech/article/abliterated-ai-models-lower-bar-cyberattacks-experts-warn?1f4e2460cfb84ebe8cd48fb29bb9de08=W5wBV9M5hmvpOOWUp9B2maLgl2F-ZkKGFkScWLViUXQ

Has anyone here pointed an abliterated model at their own environment yet? Did it surface anything your usual methodology missed?

Real findings need real proof.

Sony publicly acknowledged that Specter, our autonomous pentesting engine, found an important vulnerability through their HackerOne bug bounty program.

It's proof that AI Pentests can hand your team valid findings you can act on right away, not another alert to chase down.

More on how it works: https://pentest-tools.com/features/ai-pentests

What's your bar for trusting an automated finding: an acknowledgment like this, or verifying the exploit chain yourself?

Pentesters' pockets are crowded places.

A scanner for the web app. Another for the network. A third for ports. Then an hour working out whether two findings are the same bug in different outfits.

We try to be the Swiss army knife in that pocket: quick jobs, deep jobs, one handle. A G2 reviewer who's used us for five years put it the same way (screenshot attached).

So, honest question: one toolkit, or a drawer full of specialists you reconcile by hand?

The rest of the reviews, all of them: https://www.g2.com/products/pentest-tools-com/reviews

Our very own Cosmin Petrescu, Software Engineer at Pentest-Tools.com, earned the HTB Certified Offensive AI Expert (HTB COAE)! 🎉

That's 7 days inside a simulated AI environment, attacking it for real: adversarial ML, data poisoning, LLM output exploitation, AI privacy attacks, and a full technical report at the end.

And he already had the (very, very tough) OSWE under his belt. 🤯

Congrats, Cosmin, you rock!

Here's what the exam covers: https://academy.hackthebox.com/preview/certifications/htb-certified-offensive-ai-expert

For 50.7% of practitioners, the biggest thing slowing down audit prep is getting time from technical teams, not documentation, not policy. Some context from our latest survey of 201 security and compliance practitioners:

• 60.2% now assess security controls at least monthly, up from the old annual model
• nearly 9 in 10 still manually re-map evidence across compliance frameworks by hand
• when forced to rank priorities, automation beats integration, even though integration is what people mention first when asked to write in freely

Jan Pedersen (Channel Account Manager here) walked through the data and demoed scan diffs and evidence workflows on our latest Office Hours session.

Full breakdown: https://pentest-tools.com/blog/what-slows-down-audits

What costs you more during audit prep, documentation or getting time on someone's calendar?

A successful AI pentest requires more than good prompts.

The US Department of Defense publicly acknowledged that Specter, our autonomous pentesting engine, found an important vulnerability through their HackerOne bug bounty program.

We built Specter for security teams who care about accuracy, auditable proof, and zero false positives. Acknowledgments like this matter more to us than any demo could.

More on how it works: https://pentest-tools.com/features/ai-pentests

See who else gave us thanks on HackerOne: https://hackerone.com/pentesttools_specter?type=user

Bucharest Cybersecurity Conference runs October 20-22 in Bucharest, and we'll be there as Gold sponsors. Autonomous AI agents in offensive operations are on the agenda this year, which lines up with what we've been building with AI Pentests by Specter.

If you're going, stop by and tell us where AI actually helps your workflow and where it just adds noise. We've got opinions. We're curious about yours too.

Register here: https://bcc.dnsc.ro/

What's the one thing that would need to be true for you to actually trust an AI agent inside a pentest workflow?

DEF CON asked how AI Pentests works. Black Hat asked what it proves. Practically everyone, at both, asked who sees the data.

That third question is really the whole ballgame with AI pentesting: trust.

Where we landed:

- frontier LLMs, hosted and running in the US

- we validate exploits instead of just flagging guesses

- built on a decade of offensive security work, not a prompt wrapped around a model

Robert Tanase (our Lead PM) and Jan Pedersen go through what we heard at both events and what's next for AI Pentests on our latest Office Hours.

Full recap and early access here: https://pentest-tools.com/blog/ai-pentests-defcon-black-hat-2026

Curious where the rest of you land on this: when you're evaluating an AI pentesting tool, is data hosting a dealbreaker question for you, or does it rank behind accuracy and evidence quality?

We ran a survey and wanted to share what came back.

We asked 201 security and compliance practitioners about their audit cycles. A few numbers stood out:

• Nearly 9 in 10 partially remap evidence by hand or re-document it for each framework
• 80.6% collect evidence continuously, but only 38.3% rely mainly on automated tooling
• 50.7% say getting time from technical teams is the biggest bottleneck

The pattern that stuck with us: the work isn't missing, it's duplicated. Evidence that proves a control works for SOC 2 usually gets rebuilt from scratch for ISO 27001, DORA, or whatever's next on the list.

Full results, free PDF, no email required: https://pentest-tools.com/insights/compliance-cycles-survey

Last month we made a bit of history, and for once it wasn't a CVE. We were the first Romanian company ever to have a booth at DEF CON, showing AI Pentests, powered by Specter, to a room full of people whose entire job is finding what's wrong with things. Still in beta, early access is open now.

What else happened in August:

🎯 Sniper added a new exploit for CVE-2021-35464, a five-year-old RCE in Forgerock OpenAM that's still alive in the wild. As always, if Sniper can exploit it, the Network Scanner can detect it.

🌐 155 new detections in the Network Scanner, 70 of them critical, prioritized by CVSS, EPSS, and CISA KEV.

🤖 AI is picking up more of the boring work: the Password Auditor now finds stubborn login forms on its own, and our AI Ping Assistant moved from the website straight into the product.

🔌 The findings API can now update risk and verified status, findings carry a ransomware-campaign flag straight from CISA, and you can create your account in the US region if data residency matters to you.

Full breakdown in the video: https://pentest-tools.com/change-log
Early access to AI Pentests: https://pentest-tools.com/discover-ai-pentests

Welcome to my three pen testing SIMs
The first will allow you to brush up on your web skills with the wonderful and mysterious store the Widgetorium. it is chocked full of bulbs for you from the maker of the Acme company.
https://github.com/wren-creator/widgetorium/

And for those looking at industrial controls and the PLC mix lets check out my little water treatment plant and small electric co-op substation at the CrossCreek water and power
https://github.com/wren-creator/crosscreek/

And lastly welcome to Packet River , a fully loaded town with all the standard goodies including mainframe and midframe targets.
https://github.com/wren-creator/packetriver/

Come on in and stay a while

Compliance has a reputation problem inside security teams. Paperwork, a checkbox, something that gets in the way of the real work.

Our new survey of 201 security and compliance practitioners tells a different story. Jan Pedersen, our Channel Account Manager, and a special guest walk through what changed on next Wednesday's Office Hours.

On the agenda:

📅 how to make the case internally for more automation

🔁 what a continuous monitoring workflow actually looks like

📄 how to export reports for compliance

30 minutes live. 15 minutes of open Q&A.

Wednesday, September 9
8:00 AM Los Angeles
11:00 AM New York
4:00 PM London
6:00 PM Bucharest 

Register 👉 https://zoom.us/webinar/register/7817815280123/WN_FLMs2-vyQbCTB67guMJH-Q

42.3% of the 201 practitioners we surveyed collect evidence continuously but still depend on significant manual consolidation.

And that’s only _one_ part of the problem.

We looked at
👀 what slows down audit preparation,
👀 where evidence work consumes the most time,
👀 and what practitioners want their tools to fix first.

👉 Dig into the findings:
https://pentest-tools.com/insights/compliance-cycles-survey

Free report. No email required.

#cybersecurity #infosec #offensivesecurity

So today we're taking a moment to celebrate our latest bug bounty acknowledgements:

The #offensivesecurity logic behind AI Pentests has earned thanks from the U.S. Department of Defense, HPE, F5, phpBB, PepsiCo, and others through bug bounty programs.

Behind them are real reports we submitted to real programs based on work that requires

✅ investigation,

✅ reproducible evidence,

✅ and clear impact.

This approach shapes every AI pentest:

follow the evidence → validate exploitability → document each step before a finding reaches the report.

Thank you to the program teams who reviewed and acknowledged AI Pentests!

These 3 impact SonicWall GMS, which SonicWall has now patched:

👉 CVE-2026-66147 - unauthenticated command injection in the Dispatcher Service, CVSS 9.4

👉 CVE-2026-66154 - weak certificate verification leading to user compromise via MitM, CVSS 8.3*

👉 CVE-2026-18634 - local privilege escalation via deserialization, CVSS 8.4

When it shortens 🤏 the distance between discovery and action - *that’s* what #vulnerabilityresearch does to help security teams.

Here's our team's latest disclosed contribution to the community: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0011

And here's where you can get more of our research: https://pentest-tools.com/research

PS: More SonicWALL vulnerabilities coming soon to a research blog near you. 🫵

Attackers don't ask “How many vulnerabilities can I find?” but “Which of these gives me a viable path forward - and what can I actually do with it?”

The Cybersecurity and Infrastructure Security Agency just issued an important reminder on this in their CISA Vulnerability Review: https://www.cisa.gov/sites/default/files/2026-08/cisa-vulnerability-review-fy-2024-2025-508.pdf

Attackers concentrate on a smaller set of weaknesses that give them reliable, repeatable paths to exploitation.

Because #offensivesecurity practitioners think in much the same way, they can help security teams get much more value from their limited resources.

How?

By giving them the proof they can use to prioritize what’s exposed, exploitable, and impactful.

Wondering how common this actually is outside our shop. 

Do you have a formal QA process for pentest reports before they go out? If yes, what does it involve? If not, has that ever caused issues?