Malika Aubakirova — a16z - Next-Gen Pentesting: AI Empowers the Good Guys - June 2025
FreeAI Empowers the Good Guys in Next-Gen Pentesting
FreeFree tier
About Malika Aubakirova — a16z - Next-Gen Pentesting: AI Empowers the Good Guys - June 2025
An article by Malika Aubakirova published on a16z.com in June 2025, exploring how AI-powered tools are revolutionizing penetration testing. It highlights the emergence of autonomous vulnerability research systems, like the pseudonymous Unpatched AI, which discovered over a hundred Microsoft vulnerabilities with automated exploit chains. The piece contrasts traditional manual pentesting—scoping, reconnaissance, discovery, exploitation—with AI-driven approaches that scale faster and outperform humans in bug bounty leaderboards. It argues that defenders retain advantages of visibility and control, but that the security industry must adapt to AI-enabled attack automation.
Key Features
Autonomous LLM-steered vulnerability research pipeline
Combines fuzzing, symbolic execution, and generative AI for narration
Demonstrated ability to discover and exploit vulnerabilities at scale
Outperforms human researchers in public bug bounty leaderboards
Automates scoping, reconnaissance, discovery, and exploitation phases
Pros & Cons
Pros
- Scales security testing beyond what manual pentesters can achieve
- Faster discovery of vulnerabilities, reducing window of exposure
- Can automatically generate detailed exploit chains and writeups
- Reduces dependency on scarce human expert bandwidth
- Defenders can deploy similar tools to test their own environments proactively
Cons
- Autonomous tools may be used by bad actors if leaked or replicated
- Lack of human judgment and context could lead to false positives or missed nuanced flaws
- Traditional pentesting remains the gold standard for targeted, context-aware assessments
- The anonymous nature of tools like Unpatched AI raises accountability questions
- Requires significant compute and LLM resources to operate effectively
Best For
Automated penetration testing of large-scale software systemsContinuous security testing without waiting for consultant availabilityIdentifying previously unknown vulnerabilities (zero-days) in popular softwareChaining multiple misconfigurations into viable attack pathsAccelerating feedback loops in fast-paced software development
FAQ
What is Unpatched AI?
A pseudonymous tool that surfaced in early 2025, listing over a hundred previously unknown Microsoft Access and 365 vulnerabilities with exploit chains. It is believed to be an autonomous, LLM-steered vulnerability-research pipeline combining fuzzing, symbolic execution, and generative AI.
How are AI tools changing penetration testing?
AI tools are starting to compete with and sometimes outperform human researchers in offensive security, automating scoping, reconnaissance, discovery, and exploitation phases. They can move up bug bounty leaderboards and uncover bugs at scale without human guidance.
What advantages do defenders still have over AI-driven attackers?
Defenders maintain deep visibility, control, and context within their own environments. They can deploy similar AI tools to proactively test their systems faster.