Pentesting with AI: the harness matters more than the model

The model writes the attacks; the harness decides whether they are useful

Any AppSec team can today point an AI agent built on a general-purpose model at its own web applications with very little prior setup. The model, indeed, drafts the attacks. But everything that turns those attacks into something safe to run against production and into something worth reviewing afterwards does not live in the model: it lives in the harness that wraps it. That is where the real engineering of AI pentesting lies.

The Hacker News story puts it bluntly: the hard part is not the agent, it is the harness. And it brings up an uncomfortable context: the Hugging Face intrusion that OpenAI disclosed in July. That is, the same models capable of finding flaws in your applications are also an attack surface when deployed without adequate safeguards.

What the harness is and why it concentrates the risk

When we talk about the harness we mean everything that surrounds the model and conditions its behavior: which tools it can invoke, against which targets, with what scope limits, how its actions are logged, what is done with the results and who validates them. An agent without a harness is an unbridled generator of offensive requests. With a harness, it becomes a testing assistant that respects the perimeter, leaves traces and produces actionable findings.

The distinction is not minor for an SME. Many small companies do not have a dedicated security team and see AI as a way to cover gaps. The problem is that the barrier to entry drops a lot for launching an agent, but it does not drop one bit for controlling it. And a poorly contained offensive agent can touch systems it should not, generate traffic that triggers alerts or, worse, retain access to sensitive information without anyone knowing.

What really needs to be built

If an IT team wants to explore agentic pentesting with judgment, the work lies in these pieces, not in choosing the trendy model:

• Explicit scope: define in writing which domains, environments and time windows the agent can touch, and block everything else at the network level, not just with instructions in the prompt.
• Least privilege: the agent should not have broader credentials than those of a temporary human auditor.
• Complete logging: every action, every request and every decision must be traced so that what happened can be reconstructed.
• Human validation: the agent's findings are hypotheses until someone confirms them; without triage, the noise outweighs the value.
• Isolation: run the agent in an environment separate from production whenever possible, with copies or pre-production environments.

The Hugging Face case as a reminder

The intrusion that OpenAI made public in July fits into this discussion because it shows that the systems surrounding models are also attacked. It is not enough to protect the target application: you have to protect the infrastructure from which the agent is launched, its credentials, its dependencies and its output channels. A neglected harness is a back door with good intentions.

For an SME, the practical reading is twofold. First, that adopting AI security tools without governance is adding operational risk to the risk you were trying to reduce. Second, that the sensible investment is not in model licenses, but in processes: scope, permissions, logs and review. It is the same logic we apply when we talk about how Kubernetes faces the flood of AI agents: the platform holds up, but the policy of who does what has to be written.

Our recommendation from ForgeNEX

Before hiring or deploying any agentic pentesting solution, ask the provider to describe its harness: how it limits scope, how it logs, how it validates and how it protects its own credentials. If the answer focuses on the model and not on these controls, the conversation has not started well. At the same time, it is worth reviewing agreements with AI providers, an area where liability tends to shift toward the customer, as we already saw with the shift of legal risk for AI errors.

The agent finds; the harness protects. Without the latter, the former is just a shortcut to the incident.

In short: AI pentesting is a real promise for teams with few resources, but its value depends on the engineering that contains it. Starting with the harness, and not with the model, is the difference between a security test and a security problem.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.