Industry & Market

Picus says agentic pentests miss exposed services

Picus Security says agentic pentesting can find complex attack paths faster, but its safety limits and network reach still leave some internet-exposed services and vulnerabilities untested, including CVE-2026-33032.

The problem is simple reach: the AI agent is boxed in by guardrails and by what it can actually touch, so it may skip targets a real attacker could hit or fail before it gets there. That makes a passed run a partial result, not proof that exposed services or flagged CVEs are actually closed.

For teams using AI-assisted pentests or breach-and-attack simulation to measure exposure, the gap sits at the validation layer. If the tool never reaches the service, the estate can look clean while reachable attack surface remains unconfirmed.

1 source · Oct 14

CVE-2026-33032

NVD KEV

CVSS 9.8 CRITICAL: nginx UI is a web user interface for the Nginx web server. EPSS 3% (84th percentile).

Timeline

Oct 14 Reported by BleepingComputer

Sources

Oct 14 BleepingComputer
The Blind Spots of Agentic Pentesting and How to Close Them
Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps.
original

Vendor digest: F5

Part of the PlainSec briefing for 2026-10-14

Every edition of this story: Picus says agentic pentests miss exposed services

Industry & MarketPicus says agentic pentests miss exposed servicesPicus Security says agentic pentesting can find complex attack paths faster, but its safety limits and network reach still leave some internet-exposed services and vulnerabilities untested, including CVE-2026-33032.The problem is simple reach: the AI agent is boxed in by guardrails and by what it can actually touch, so it may skip targets a real attacker could hit or fail before it gets there. That makes a passed run a partial result, not proof that exposed services or flagged CVEs are actually closed.For teams using AI-assisted pentests or breach-and-attack simulation to measure exposure, the gap sits at the validation layer. If the tool never reaches the service, the estate can look clean while reachable attack surface remains unconfirmed.1 source · Oct 14

CVE-2026-33032

NVD KEV

CVSS 9.8 CRITICAL: nginx UI is a web user interface for the Nginx web server. EPSS 3% (84th percentile).

Timeline

Oct 14 Reported by BleepingComputer

Sources

Oct 14 BleepingComputer

The Blind Spots of Agentic Pentesting and How to Close Them

Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps.

original

Vendor digest: F5Part of the PlainSec briefing for 2026-10-14Every edition of this story: Picus says agentic pentests miss exposed services