Využití AI agentů v oblasti penetračního testování

Abstract

This bachelor thesis investigates the use of autonomous agent systems based on large language models for penetration testing of web applications. In the practical part, three variants of an agent system are designed and implemented. They share the same set of tools and system prompts but differ in orchestration: a single-agent system, a multi-agent system with an orchestrator built on the OpenAI Agents SDK, and a multi-agent system driven by a state graph built on top of LangGraph. All variants are evaluated against OWASP Juice Shop with the commercial GPT-5 model and locally hosted MiniMax M2 models, and compared with the existing tools PentAGI, PentestGPT, and Shannon. The experiments show that the choice of architecture mainly affects token consumption and run cost, while overall success depends on the capabilities of the underlying language model.