Researchers make an AI team that does a penetration test without help
The system used a software flaw to get in on 64.9 percent of tries, and no other group did a test of it.
Claimed, not confirmed
Researchers at Harbin University of Science and Technology and a police laboratory in Sichuan Province made PentestMCP, a group of AI agents. The agents do a penetration test. This is an approved attack on a computer system to find weak points. The authors report tests on more than 100 known flaws with GPT-5.2. The average success rate was 74.0 percent for the step to find flaws.
How it works
PentestMCP lets a language model use known tools, such as Nmap and Metasploit, through one standard interface. The authors report that this cuts the errors that occur when a model writes its commands.
The agents keep a task graph. This is a set of tasks that the agents change when they get new facts about the target.
The numbers
With GPT-5.2, the average success rates for more than 100 known flaws were:
- Information gathering: 87.2 percent
- Find flaws: 74.0 percent
- Use a flaw to get in: 64.9 percent
The authors compare the system with PentestGPT and other systems. They give no numbers for those systems here.
Self-learning
When the system makes a new exploit, it keeps it in a knowledge base. The authors report that the system will learn from each test.
What is not known
No other group did a test of these results. The numbers come from tests by the authors.
Sources
Posted
