Agentic AI pentesting benchmarks raise new governance questions for SQLi

At a glance

What this is: Synack benchmarked an agentic AI pentest system against 10 PortSwigger SQL injection labs and says it solved all 10, including 90% within a practitioner time window.

Why it matters: This matters because teams evaluating agentic AI for offensive testing need to decide where automation can extend coverage and where human validation remains necessary for trustworthy findings.

By the numbers:

• Synack says its agentic AI pentest system solved 10 of 10 PortSwigger SQL injection labs in January 2026.
• Synack says 90% of the labs were completed within a standard practitioner time window.
• Synack says one lab was missed by just 18 seconds.
• Synack says the benchmark covered 10 labs with a total of 10 attempts.

Context

Agentic AI pentesting turns offensive security work into a tool-orchestrated workflow, but the governance question is not whether the system can find flaws. The harder question is how much trust to place in an autonomous testing path when output quality depends on prompt, payload selection, and iteration order. For IAM and security teams, the relevant issue is evidence quality, not just test speed.

Synack positions Sara Pentest as an agentic AI system with human oversight focused on validating identified vulnerabilities. That makes this less about replacing pentesters and more about defining where AI-assisted testing is acceptable in the assurance chain. The article is fundamentally about whether agentic testing can be used as a credible part of security validation without overstating what automation has actually proven.

In practice, this is typical of emerging agentic security tooling: strong at exploration, less settled at assurance and decision-grade validation. Teams should read the benchmark as a signal to tighten governance around how AI-generated findings are accepted, verified, and operationalised.

Key questions

Q: Where does agentic pentesting fail in practice for SQL injection testing?

A: It fails when teams assume a solved lab is the same as a validated production finding. SQL injection work can depend on timing, payload iteration, and indirect confirmation, so automation may discover a path without proving business-relevant exploitability. Human review is needed to judge whether the evidence is reproducible, scoped correctly, and strong enough for remediation.

Q: Why does blind SQL injection create a real access-risk problem?

A: Because the end state is often credential theft, not just data disclosure. Once an attacker can extract an administrator password or equivalent secret, the vulnerability shifts from application integrity to account takeover and privileged access. That is why credential exposure and authentication controls matter as much as the original injection flaw.

Q: How should security teams govern agentic AI in penetration testing workflows?

A: Security teams should keep agentic AI inside a bounded workflow where scope, tool access, and approval rules are enforced by the testing platform, not the model. The human tester should control what the agent can pursue, what requires approval, and what remains blocked. That preserves judgment, auditability, and accountability while still offloading repetitive investigation work.

Q: What should teams do before relying on AI-generated pentest results?

A: Define a review workflow that checks reproducibility, scope, and evidence strength before any AI-generated result changes risk posture. Without that gate, teams can overstate coverage or understate uncertainty. The right control is a decision process that turns machine-assisted discovery into human-approved assurance.

Technical breakdown

How agentic pentesting assembles a SQLi test path

Agentic pentesting uses LLM-driven planning plus specialist actions to probe, interpret responses, and iterate until a payload works. In SQL injection labs, that usually means finding an input surface, inferring the database type, and adapting payloads as the system learns from each response. The key mechanism is not raw exploitation alone but closed-loop experimentation. That makes the system closer to a dynamic test operator than a fixed scanner.

Practical implication: score agentic tools on repeatable decision quality, not only on whether they eventually reach a flag or proof of compromise.

Why blind and out-of-band SQLi are a governance stress test

Blind SQL injection and out-of-band interaction are hard because success depends on inference, timing, and indirect confirmation rather than obvious error messages. That stresses an agent because it must reason about weak signals and choose between alternative paths without human prompting at every step. For security governance, those are exactly the cases where false confidence is most likely if teams treat one successful run as universal proof.

Practical implication: require separate validation for indirect-execution findings instead of assuming one solved lab generalises to production exposure.

Where human oversight still sits in the assurance chain

Human oversight matters when an autonomous system has identified a likely flaw but the organisation still needs to decide whether the evidence is accurate, exploitable, and relevant to the asset in scope. Agentic output can accelerate discovery, but it does not eliminate the need to judge context, business impact, or compensating controls. In other words, automation can widen coverage while humans still own the final security decision.

Practical implication: keep humans in the approval path for findings that will drive remediation priority, risk acceptance, or board reporting.

Threat narrative

Attacker objective: The objective is to prove exploitable SQL injection paths and demonstrate that iterative, tool-driven testing can reach sensitive backend data.

1. Entry begins with the agent probing application inputs for injection surfaces and learning which parameters influence backend queries.
2. Credential_harvested is not the right pattern here, so the system instead escalates by refining payloads until it can influence database behaviour and extract information.
3. Impact is the successful retrieval of data or proof of exploitability from SQLi lab targets, demonstrating that the vulnerable input path can be turned into application compromise.

Breaches seen in the wild

• Commvault Metallic breach 2025: A nation-state actor exploited a Commvault zero-day in Azure and may have taken app secrets that open customers' Microsoft 365 tenants.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agentic pentesting raises an evidence-quality problem before it raises an efficiency problem. The central governance issue is not whether an agent can produce a finding, but whether that finding is decision-grade enough to support remediation, exception handling, or executive reporting. In security programmes, proof without context can mislead as easily as it can help. Practitioners should treat agentic testing as an input to assurance, not a substitute for assurance.

SQL injection remains a useful benchmark because it exposes the limits of autonomous reasoning under ambiguous conditions. Simple cases reward pattern matching, but blind and out-of-band paths force the system to infer causality from weak signals. That is where AI-assisted testing reveals its boundary: broad exploration may be strong, but confidence calibration is still a human governance task. Practitioners should separate discovery speed from finding validity.

Agentic security tooling creates a new governance debt: validation now has to keep pace with autonomous discovery. The more quickly a system can generate candidate vulnerabilities, the more rigor organisations need in triage, retest, and acceptance criteria. This is especially important when the outputs influence risk registers or vulnerability remediation priorities. Practitioners should formalise how agentic findings are reviewed before they enter the control system.

Human oversight in agentic pentesting should focus on scope, interpretation, and remediation value, not on replaying every step of the attack. The article’s model is strongest when AI expands coverage and humans arbitrate what matters. That is a healthier governance pattern than either blind trust in automation or rejection of machine-led testing. Practitioners should design review checkpoints around materiality, reproducibility, and asset criticality.

Agentic AI security work is beginning to resemble continuous control testing rather than one-off assessment. If benchmark performance improves over time, organisations will increasingly use these systems to supplement penetration testing, red teaming, and validation of web application exposure. That will shift expectations for how quickly teams can prove control effectiveness. Practitioners should prepare governance for more frequent, AI-assisted assurance cycles.

From our research library:

• 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
• Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
• Read next: Agentic AI Security Guide

What this signals

Agentic AI testing changes the pace of assurance, but not the governance burden. The more quickly systems can explore SQL injection paths, the more important it becomes to formalise how findings are validated before they affect remediation priorities or risk reporting. The practical question is no longer whether AI can find issues, but whether the organisation can govern the proof that comes back from it.

Evidence-quality drift: as autonomous testing expands, teams risk treating fast discovery as equivalent to defensible assurance. That is a mistake. Governance needs to distinguish raw candidate findings from validated vulnerabilities, especially when indirect techniques such as blind SQLi depend on inference rather than direct confirmation.

67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey. That matters here because agentic systems that test, triage, or remediate security issues still inherit the identity and access controls of the environments they touch.

For practitioners

• Define acceptance criteria for agentic findings Set rules for what counts as a valid, reproducible, and material vulnerability before an AI-generated result can enter remediation tracking.
• Separate discovery from adjudication Let autonomous tools explore the attack surface, but require human review before any result is used for risk acceptance, reporting, or prioritisation.
• Retest indirect-execution findings manually Treat blind SQLi and out-of-band cases as higher-governance findings because they depend on inference and can be misread by automated tooling.
• Align AI testing with web application controls Map agentic pentest outcomes to application security controls so that SQL injection validation feeds the same governance process as human testing.

Key takeaways

• Agentic pentesting can expand coverage quickly, but coverage alone does not prove that a finding is decision-grade or production-relevant.
• Blind and out-of-band SQL injection cases show why autonomous testing still depends on human validation when the signal is indirect.
• The governing control is no longer only test execution. It is the review process that separates machine-assisted discovery from approved security assurance.

Key terms

• Agentic Pentesting: An approach to penetration testing that uses AI-driven systems to support planning, execution, or interpretation of tests. The key issue is not automation by itself, but whether the environment provides enough context for the output to be accurate, prioritised, and operationally useful.
• Blind SQL Injection: Blind SQL injection is a variant where the application does not return obvious database output or errors, so the attacker infers information from timing or true-false response differences. It is harder to spot and often requires behaviour-based detection.
• Out-of-Band Interaction: A testing or exploitation method that confirms success through a separate channel, such as a callback or external interaction, rather than the immediate response. In assurance workflows, it is a stronger signal than guesswork but still requires careful validation and scoping.
• Evidence Quality: Evidence quality is the degree to which identity artifacts such as photos, biometrics, and document data are usable and trustworthy. A record can be complete but still fail if the evidence is blurred, mismatched, or otherwise unusable for verification or investigation.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, agentic AI identity, machine identity security, and secrets management through the industry's only accredited NHI security programme. It helps security and IAM practitioners build the governance vocabulary needed for autonomous systems and non-human access.