Industry · 13h ago

Picus says agentic pentests miss exposed services

Picus Security says agentic pentesting can find complex attack paths faster, but its safety limits and network reach still leave some internet-exposed services and vulnerabilities untested, including CVE-2026-33032.

The problem is simple reach: the AI agent is boxed in by guardrails and by what it can actually touch, so it may skip targets a real attacker could hit or fail before it gets there. That makes a passed run a partial result, not proof that exposed services or flagged CVEs are actually closed.

For teams using AI-assisted pentests or breach-and-attack simulation to measure exposure, the gap sits at the validation layer. If the tool never reaches the service, the estate can look clean while reachable attack surface remains unconfirmed.

Timeline

• Oct 14 Reported by BleepingComputer

Sources

1 source covering this story

• BleepingComputer Oct 14

  The Blind Spots of Agentic Pentesting and How to Close Them

  Picus Security explains how combining agentic pentesting with exposure validation and breach simulation can help close these gaps.

Entities

• CVE-2026-33032

Vendor digest: F5

Part of the PlainSec briefing for 2026-10-14

Editions

• Briefing for 2026-10-14