[rando77]

Sounds like they need another agent to detect false positives (I joke, I joke)

[dotty-]

You joke, but that's a very real approach that AI pentesting companies do take: an agent that creates reports, and an agent that 'validates' reports with 'fresh context' and a different system prompt that attempts to reproduce the vulnerability based on the report details.

*Edit: the paper seems to suggest they had a 'Triager' for vulnerability verification, and obviously that didn't catch all the false positives either, ha.

[tptacek]

Can't be any worse than Fortify was!