Skip to main content

Black-Box Pentest

Black-Box Pentest probes your live application over HTTP and through a headless browser, with no access to your source code. AI agents model the attack surface, test for exploitable vulnerabilities with crafted payloads, and produce evidence-backed findings. Everything runs in isolated sandboxes with controlled network egress, so it is safe against live and staging applications.

When to use it​

Use a black-box pentest when:

  • You have a running application you can reach over HTTP.
  • You do not have (or do not want to grant) source code access.
  • You want real, exploitable vulnerabilities with proof you can replay, rather than only the results of a static scan.

You configure one or more target URLs, optional credentials, and scope rules. The agents do the rest: they crawl, model, test, triage, and report without human intervention.

What it is not​

A black-box pentest is blind: it does not see your source code. The agents reason about your application's behavior from the outside, so they cannot inspect logic that never surfaces through HTTP. A black-box pentest does not find vulnerabilities that can only be seen in the source, such as tainted data flows or unsafe deserialization in library code.

For source-level analysis, use Source Code Audit. For a combined view, a white-box pentest pairs static analysis with live probing.

Safety​

The sandbox reaches only the targets you specify plus any allowed domains you add. It cannot touch your internal network, it does not follow redirects outside your scope, and AISafe destroys it when the run ends. See Security & scope.

Chapters​