AI agents can now write, run and publish their own exploit code
A new wave of AI models can draft an attack, run it, read the output and iterate without a human in the loop. That raises the bar for what counts as proof, and it is exactly how the Sintropyc agent already works.
A new class of AI models has crossed a line that matters for security: they no longer just suggest code, they write an attack, execute it, read the result and adjust. Give one a target and an objective and it will enumerate the surface, draft a request, send it, inspect the response, and try again until something works, the same loop a human penetration tester runs.
Why this changes the conversation
For years the honest caveat about offensive tooling was that a model could describe a vulnerability but could not prove one. That gap is closing. When an agent can run its own payload and observe a real effect, the output stops being a guess and starts being evidence, provided the effect is actually demonstrated and not just reflected back.
That distinction is the whole game. A reflected string is not a reproduced bug. An agent that publishes findings has to hold itself to proof: a fingerprint, an exec oracle, an auth-boundary crossing, a canary that comes back.
Sintropyc's rule has not changed: proof, not guesswork. Severity is capped at what the agent actually demonstrates on an authorized target, never at what it suspects.
What it means for teams shipping AI-built apps
- The attacker's cost to probe your app keeps falling, so untested trust boundaries get found faster.
- "It passed the feature test" says nothing about whether another tenant can reach the same object.
- The defence is the same as it has always been, just more urgent: test the server's authorization decisions, prove each finding, and re-test after you ship.
This is the model Sintropyc runs as a service. The agent does the full kill-chain against an authorized target, proves every finding with a working exploit, hands you the exact fix, and re-tests once you deploy.
Related reading: Why AI-generated code still needs security testing.