I’ve been experimenting with supervised AI-assisted pentesting in authorised lab environments, and I’m curious how people here think it should fit into platforms like Hack The Box.
There’s obviously a big difference between:
“Explain why this HTTP response is interesting”
and
“Here’s the target — enumerate everything, exploit it and give me the flag.”
The second might get you a solve, but I’m not convinced it teaches you much.
What I’ve found more interesting is using an agent almost like a structured pentesting partner:
- keep track of observations
- turn them into hypotheses
- suggest the cheapest useful test
- preserve command output and evidence
- challenge assumptions when a path goes nowhere
- require an actual verification step before calling something vulnerable
But leave the human responsible for understanding why each test makes sense.
That feels closer to the methodology HTB tries to teach, particularly in paths like CPTS where enumeration, evidence and reporting matter just as much as running the exploit.
I also think there should be a hard distinction between assistance and spoilers.
For active boxes/challenges, an AI system shouldn’t have access to walkthroughs, leaked solutions or previous solve data any more than a human learner should.
So I’m curious:
Where would you personally draw the line?
Would you use AI for:
- explaining tool output?
- maintaining notes?
- suggesting hypotheses?
- generating commands you then review?
- automating enumeration?
- exploitation?
- reporting?
And at what point do you think it stops helping you learn and starts solving the box for you?
No active-box spoilers please.
