Ai-pentesting

We ran KLUE against the same live production target four times, once each behind GLM 5.2, DeepSeek V4 Pro, Kimi K2.7 and Opus 4.8, all on an identical thirty minute budget. Same target, same clock, four risk verdicts from Low to Critical. A field report on what each model sees, what it walks past, whether it got the severity right, and why the cheapest run came back with the most.

We gave our autonomous pentesting agent, KLUE, one real engagement against a mature open-source codebase and 2 hours 43 minutes on the clock. It came back with six CVE-assigned vulnerabilities, including a chained second-order SQL injection and a template injection that reached a shell. This is the annotated reasoning trace.

We pointed OWASP ZAP, Burp Suite, Acunetix, and our own KLUE at the same live, deliberately-broken web app. Three of them crawled it and reported headers. One forged an admin token, dumped every user, and reset the admin password, all from two requests, unauthenticated. A field report on what dynamic scanners can and cannot reach.

A SAST benchmark on OWASP Juice Shop pitting Semgrep, SonarQube, and Snyk Code against KLUE, our autonomous source code analysis platform. The story is in the precision column, and in the vulnerability classes that have no pattern to match at all.

We ran four frontier models through the same autonomous pentest engagement. Recall, time to finish, and dollars per run all tell different stories, and Kimi K2.6 turned out to be the surprise on the leaderboard.