Skip to main content

Black-Box Pentest

Black-Box Pentest probes your live application over HTTP and through a headless browser, with no access to your source code. AI agents model the attack surface, test for exploitable vulnerabilities with crafted payloads, and produce evidence-backed findings. Everything runs in isolated sandboxes with controlled network egress, so it is safe against live and staging applications.

When to use it​

Use a black-box pentest when:

  • You have a running application you can reach over HTTP.
  • You do not have (or do not want to grant) source code access.
  • You want real, exploitable vulnerabilities with proof you can replay, not just a static scan.

You configure one or more target URLs, optional credentials, and scope rules. The agents do the rest: they crawl, model, test, triage, and report without human intervention.

What it is not​

A black-box pentest is blind. It reasons about your application's behavior from the outside, so it cannot inspect logic that never surfaces through HTTP. It does not find vulnerabilities that need source to see, like tainted data flows or unsafe deserialization in library code.

For source-level analysis, use Source Code Audit. For a combined view, a white-box pentest pairs static analysis with live probing.

Safety​

The sandbox reaches only the targets you specify plus any allowed domains you add. It cannot touch your internal network, it does not follow redirects outside your scope, and AISafe destroys it when the run ends. See Security & scope.

Chapters​