TLDR Tech / InfoSec
New Legal Questions: Agentic Pentesting
Many of the risks that come with agentic pentesting may already be covered by protections similar to those in current contracts. However, a fundamental difference is that an agent may not have a human pentester's intuition regarding rate limiting and when to stop testing. Some problems don't have clear precedents, such as prompt injection via the target, authorization, cross-engagement contamination, and non-determinism. The issue of agentic identity undercuts these concerns as multi-agent workflows may complicate attribution and auditing.
Read the full story