Pentest agents and agentic workflows: where offensive AI fits next to AppSec platforms

What changed in 2026

Until recently, AppSec platforms mostly scanned: they matched code and dependencies against rules and advisories. In 2026 several vendors added AI that behaves more like an attacker or a researcher, looking for exploitable paths or testing running systems. This note sets out what each vendor says, from pages read on 27 September 2026.

What each vendor describes

Snyk Evo Continuous Offensive Security. Generally available from 4 August 2026, for AI-driven pentesting and red teaming of AI agents. Snyk announced it alongside general availability of Snyk Secrets and a public preview of a remediation agent.

OX Agentic Pentester. Listed as one of OX Security's products. On our scores it is part of OX Security's triage reason, because OX describes tying exploitable issues back to code and APIs. OX prices it per agent hour, according to its pricing page; the price itself is not published.

Semgrep Agentic Workflows. Nine pre-built workflows in public beta from 28 July 2026 combine program analysis with AI reasoning to hunt for classes such as SQL injection, XSS, SSRF and command injection, covering 70+ CWEs.

Aikido Security Altar. Released on 21 September 2026: an open-weight security model derived from GLM-5.3 through expert pruning and quantization, which Aikido says lets organizations run vulnerability detection and pentesting inside their own infrastructure.

How offensive AI relates to triage

A scanner finding says "this pattern exists". An offensive test says "this path can be used". That second statement is exactly what triage needs. Where offensive results flow back into the findings queue, they can raise a finding's priority or confirm that a low-priority finding can wait.

The questions to ask are practical:

• Do offensive results attach to existing findings, or arrive as a separate list?
• What is in scope: application code, APIs, running services, or AI agents themselves?
• Where does it run: the vendor's cloud, your infrastructure, or both? Aikido's Altar is aimed at running inside your own infrastructure.
• What is the release stage and the pricing unit?

Why we do not score it separately

Our question is about governing software built with coding agents and using agents for AppSec work across the SDLC. Offensive testing touches that question through triage, so we credit it there where a vendor describes the link. A separate criterion would favor vendors with a testing product regardless of how it feeds the rest of the work. If offensive testing is central to your buying decision, read the vendors' own pages and treat our triage score as one input.

What to watch

Three of the four features above are less than three months old at the time of writing, and one is in public beta. Expect scope, pricing units and stages to change. We will note changes in the release status note when vendors update their pages.

How to trial offensive AI safely

Offensive features act like an attacker, so treat a trial like any authorized test. Agree the scope in writing, point the tool at a non-production environment first, tell the teams who own the systems in scope, and decide in advance who reviews the results. Ask the vendor what the tool will and will not do on its own, whether it can be stopped mid-run, and where the evidence it collects is stored. Then check whether its findings arrive in the same queue your triage and fix agents work from. If they arrive in a separate list, someone has to merge them by hand, and the triage value drops.