Đồ án tốt nghiệp - Developing pentest AI agent

HCMC UNIVERSITY OF TECHNOLOGY AND EDUCATION
FACULTY OF INTERNATIONAL EDUCATION


PROJECT

DEVELOPING PENTEST AI AGENT
Instructor: Ph.d Nguyễn Đăng Quang
Students: 21110780 - Nguyễn Duy Mạnh

Ho Chi Minh City, Dec 2025

HCMC UNIVERSITY OF TECHNOLOGY AND EDUCATION
FACULTY OF INTERNATIONAL EDUCATION


PROJECT

DEVELOPING PENTEST AI AGENT
Instructor: Ph.d Nguyễn Đăng Quang
Students: 21110780 - Nguyễn Duy Mạnh

Ho Chi Minh City, Dec 2025

HCMC University of Technology and Education

SOCIALIST REPUBLIC OF VIETNAM,

FACULTY OF INTERNATIONAL EDUCATION

Independence – Freedom – Happiness

_________

__________

OBJECTIVES FOR PROJECT

Student: Nguyen Duy Manh

Student ID: 21110780

Major: Information Technology - Software Engineering
Project: Developing pentest ai agent
Instructor: Ph.d Nguyễn Đăng Quang

1. Objectives:
This project aims to develop an AI-driven penetration testing agent capable of
automating key aspects of ethical hacking. By integrating artificial intelligence with
traditional security testing tools, the system enhances both efficiency and effectiveness.
A cooperative multi-agent framework is implemented to handle various testing phases,
ensuring modularity and scalability.

2. Time of ution: 12 weeks
Signature of student:

TP.HCM, Day…. month…. year….
HEAD OF IT DEPARTMENT

INSTRUCTOR

(Sign with full name)

(Sign with full name)

INSTRUCTOR’S EVALUATION SHEET
Student Name: Nguyễn Duy Mạnh

Student ID: 21110780

Major: Software Engineering
Project title: Develop pentest ai agent
Instructor:
EVALUATION
1. Content of the project:
.......................................................................................................................................
.......................................................................................................................................
.......................................................................................................................................
2. Strengths:
.......................................................................................................................................
.......................................................................................................................................
.......................................................................................................................................
3. Weaknesses:

...

...
adapt or improve
based on past performance, limiting long-term optimization.

46



No vulnerability prioritization: While vulnerabilities can be detected, the
system lacks risk ranking or scoring to guide decision-making effectively.



LLM dependency: Some agent decisions (e.g., payload ion or error
interpretation) rely heavily on LLM reasoning, which may introduce
inconsistencies under ambiguous contexts.

6.3 Future Development Plan
Several directions are proposed to enhance and extend the system:


Post exploit integration: It is possible to expand the attack scope, such as after
exploiting sql, you can log in and get more information, or FLI, you can
connect to that system.



Incorporate reinforcement learning capabilities: This would allow agents to
adapt over time, improving payload effectiveness and strategy ion for
different targets.



Develop an interactive dashboard: A visual interface (e.g., Streamlit or webbased dashboard) could offer real-time monitoring and reporting.



Integrate advanced testing tools: Adding tools such as Burp Suite API,
OWASP ZAP, or source code analyzers would enable hybrid (black-box/whitebox) testing support. Agent that can interact web to input, submit, post payload
manualy



Optimize for performance and cost: Lighter LLMs (e.g., GPT-4o-mini or
open-source natives) may be used to reduce latency and operational
expenses while maintaining reliability.



Enable task planning and dynamic sequencing: Giving agents the ability to
autonomously determine optimal toolchains and task flows based on real-time
context.

47

CHAPTER 7 : REFERENCES
[1]. Cybersecurity Ventures. (2020). “Cybercrime to cost the world $10.5 trillion
annually by 2025.” from https://cybersecurityventures.com/hackerpocalypsecybercrime-report-2016/
[2]. Microsoft. (2025). AutoGen: Enabling next-gen LLM applications via multiagent conversation. GitHub. https://github.com/microsoft/autogen
[3]. Ag2. (2025) https://ag2.ai/
[4]. OpenAI. (2025). GPT-4 Technical Report. https://openai.com/research/gpt-4
[5]. SentinelOne. (2025). Purple AI: Accelerating EDR with AI-based threat hunting.
Retrieved from https://www.sentinelone.com
[6]. Penetration Testing ution Standard (PTES). (2022). Retrieved from
http://www.pentest-standard.org/index.php/
[7]. CrewAI. GitHub Repository: https://github.com/joaomdmoura/crewai
[8]. AI Agent Orchestration. (2025) https://www.ibm.com/think/topics/ai-agentorchestration

48