Why it matters
An annual penetration test describes a system that stopped existing the week after it was written. Agentic systems move faster than the report cycle built to govern them.
Use case · Daily PenTest
Applications change daily. Assessment should too.
A new tool gets connected. A system prompt gets edited. An application is added by a team that didn't file a ticket. A model gets swapped for a cheaper one and behaves differently under pressure.
apisec re-runs the exploits every day and reports what's exploitable right now, what changed since yesterday, and what's been proven closed. Delivered to the team, the deploy gate, and the record.
Proof you get
A dated, replayable record of exploitability over time, suitable for audit and for the board.
What an agent exploit actually looks like
One chain, start to finish.
- An attacker plants instructions in content the agent is expected to process: a support ticket, a document, a webhook payload.
- The agent reads it and selects a tool. Behaving normally, doing what it was built to do.
- The tool call goes to an internal API using the agent's standing token.
- The API authorizes on identity, not intent, and returns records belonging to another tenant.
- A second call moves the data to a location the attacker can read.
Every step passes its own review. The chain is the breach. apisec runs it end-to-end and shows you the whole path.
Reproducibility
Run it twice. Get the same answer.
apisec uses models to reason about your agents and to generate attacks. It does not use a model to decide whether an attack worked. Execution is the arbiter: deterministic, repeatable, replayable, auditable.
That matters more here than anywhere else you run. A system that behaves differently on every invocation cannot be governed by a tool that behaves differently on every invocation.
Before you test
First, find the agents you didn't know you had.
The free Surface tools produce what you need before an exploit run.
- agents, MCP servers, and LLM call sites in your code
- exposed secrets in MCP configuration
- shadow and undocumented API surface
- the AI-BOM, API-BOM, and S-BOM