As far as black-box testing, I haven't seen anything that impressive yet. Most of the open source ones have found mostly simple vulnerabilities. I think of it as a slight step up from a commercial scanner. With the current cost of tokens and the fact that all of these companies are burning through money, it's just not practical for most companies.
Things will change when the token cost gets really cheap and/or it's efficient enough to run at the speed we have now on off-the-shelf hardware.","title":null,"type":"comment","url":null},{"author":"appsecsanta","children":[],"created_at":"2026-04-15T05:32:23.000Z","created_at_i":1776231143,"id":47775044,"options":[],"parent_id":47750350,"points":null,"story_id":47750350,"text":"Agree. Everything finding real CVEs right now is source-aware \u2014 XBOW, Big Sleep, ZeroPath. Black-box is still "commercial scanner +10%."
Per-token price dropped ~10x this year, so the economics might shift faster than either of us expects.","title":null,"type":"comment","url":null}],"created_at":"2026-04-13T11:08:00.000Z","created_at_i":1776078480,"id":47750350,"options":[],"parent_id":null,"points":1,"story_id":47750350,"text":null,"title":"The Rise of AI Pentesting Agents: A Technical Analysis (2026)","type":"story","url":"https://appsecsanta.com/research/ai-pentesting-agents-2026"}