Notifications
Clear all
Topic starter
11/08/2026 3:17 pm
TL;DR: Agent harnesses combined with Model Context Protocol servers and persistent knowledge stores can cut time to find issues from days to hours and surfaced two information leaks totaling more than 12 million records, according to Bishop Fox. The practical shift is not replacing testers, but giving them deterministic tooling, better coverage, and tighter human oversight.
NHIMG editorial — based on content published by Bishop Fox: MCP agent harnesses for penetration testing
By the numbers:
- Agent harnesses cut time to find issues from days to hours and surfaced two information leaks totaling more than 12 million records.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
- Only 44% of organisations have implemented any policies to manage their AI agents.
Questions worth separating out
Q: How should security teams govern AI agents used for offensive testing?
A: Treat offensive AI agents as distinct workloads with explicit ownership, scoped tools, and logged approvals.
Q: What breaks when an AI tester has broad tool access?
A: Broad tool access makes the agent harder to audit, easier to misdirect, and more likely to overreach its intended scope.
Q: How do you know an agentic testing workflow is actually under control?
A: You know it is controlled when every delegated action is attributable, repeatable, and bounded by the intended test plan.
Practitioner guidance
- Define least-privilege tool bundles for agent harnesses Limit each harness to the minimum set of tools needed for a specific testing phase, such as reconnaissance, HTTP analysis, or cloud enumeration.
- Separate prompts, plans, and sensitive artefacts Store test plans, credentials, and collected evidence in distinct locations so the model cannot freely reuse data outside the current task.
- Instrument every delegated command and tool call Log the command, target, input context, and result location for each agent action, then review those logs alongside the final report.
What's in the full article
Bishop Fox's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step prompt structures for external, application, and cloud penetration tests using MCP-enabled agents
- Examples of tool descriptions and scoped commands that shape how the agent executes each assessment phase
- Practical notes on when to use read-only cloud accounts versus client-provided inference environments
- The article's working assumptions about human oversight, testing ethics, and scope boundaries
👉 Read Bishop Fox's analysis of MCP agent harnesses in penetration testing →
MCP agent harnesses in pen testing: what changes for practitioners?
Explore further
11/08/2026 3:29 pm
Agent harnesses are becoming a practical control surface, not just a productivity layer. Once an LLM can call scanners, proxy tools, and cloud CLIs, the workflow itself becomes a governed security asset. That means permissioning, logging, and review matter as much as the quality of the prompts. For identity teams, this is a reminder that machine actors need scoped access models, not informal trust.
A question worth separating out:
Q: Who is accountable when an AI system used for security testing crosses into abuse?
A: Accountability sits with the organisation that grants access, defines scope, and approves the workflow. That usually includes security leadership, platform owners, and the teams managing the AI toolchain. If a model can act on behalf of a business process, the business must control the identity, permissions, and audit trail behind it.
👉 Read our full editorial: MCP agent harnesses are accelerating penetration test coverage
