PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Using MCP Agents for Penetration Testing

bishopfox.com | blog | #ai-security | #cloud | #pentesting | #agentic-ai | #mcp | #offensive-security | #ai-agents | #pentest | #bishop-fox
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox on MCP agents in pen testing: agent harnesses cut time-to-finding from days to hours across external, application and cloud tests, surfacing leaks of over 12 million records.
Published
Collected

Related coverage

blog · aikido.dev
Adding Aikido AI pentesting to your existing security stack
How to add Aikido's AI pentesting on top of the SAST, SCA and cloud tools you already run, from your first pentest through whitebox testing, continuous testing and remediation.
tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
blog · xbow.com
Introducing Autonomous Exposure Management: Offensive Security at Enterprise Scale
XBOW tests your whole external application estate the way an attacker would, with no source code and no credentials, and proves what is exploitable.
blog · xbow.com
Grok 4.7 Is Different. So Is the Best Way to Use It.
XBOW tested Grok 4.7 on exploit crafting and agentic pentests: inside xAI's Build it improved substantially over 4.6, outside Build it slipped slightly—orchestration now matters as much as prompts.
blog · about.gitlab.com
New MCP tools help platform teams scale automation safely
GitLab 19.4 expands the GitLab MCP server tool set so agents can run pipelines, open merge requests, and triage vulnerabilities, while writes, merges, and deletes still wait for a human reviewer.
blog · yeswehack.com
How to use Codex for Bug Bounty research: explore broadly, validate rigorously
YesWeHack on using Codex for bug bounty research: in black-box labs it exploited a DOM XSS in under four minutes and won admin access via a JWT flaw, with subagents and skills aiding validation.
Back