Blog
Research, benchmarks, and field notes.
How RedPick performs against public benchmarks, what we find in real applications, and where AI-driven offense and defense are heading.
MCP for Pentesting: Let AI Agents Run the Full Pentest Lifecycle
Many security MCP servers only read reports or start scans. RedPick's lets your AI agent run a real pentest end to end: authorize, launch, monitor, retest. Early access.
READ THE ARTICLEBlack-Box vs Source-Assisted Benchmarks
Doyensec, Invicti and RedPick scored 49, 31, 52 and 55 on Fider and Photoview. Mode and validator decide what those AI pentest numbers mean. With sources cited.
READ THE ARTICLEAI Pentesting Buyer's Checklist (2026)
Twelve questions to evaluate AI pentesting tools in 2026: exploit proof, testing mode, false positives, reproducible benchmarks, and a clear retest path.
READ THE ARTICLEHackTheAgent 5/5: RedPick on the HackAIcon AI-Agent CTF
RedPick solved all 5 HackTheAgent challenges server-confirmed: prompt injection, refusal mining, business-logic abuse, and SSRF to an internal endpoint.
READ THE ARTICLEArgus Benchmark: RedPick 57/60 Black-Box
RedPick captured 57/60 flags on Pensar's Argus black-box benchmark, and 60/60 after narrow upstream patches to three runtime-blocked labs. Raw and patched results are reported separately.
READ THE ARTICLEDuck Store Benchmark: RedPick 20/20
RedPick found all 20 known Duck Store vulnerabilities in source-free grey-box mode, plus 88 validated extras at 95.6% extended precision.
READ THE ARTICLE55 Black-Box Findings on the Apps from Doyensec's Aikido vs XBOW Study
RedPick ran Doyensec's two Aikido-vs-XBOW apps, Photoview and Fider, fully black-box: 55 extended true positives and 34 valid findings beyond the answer key, with no source code.
READ THE ARTICLE16/16 on HackBench: From UNION SQLi to 3-Stage RCE
RedPick scored a perfect 16/16 (4000/4000 points) on HackBench's CVE-based web challenges, from UNION SQL injection to a three-stage RCE chain, fully automated.
READ THE ARTICLEProjectDiscovery Vibe-Coding: 152 Findings, 0 FP
RedPick reached 74/74 ground truth on ProjectDiscovery's Vibe-Coding Benchmark plus 78 additional verified vulnerabilities: 152 findings, 10 attack chains, 0 false positives.
READ THE ARTICLEThe AI Attacker Era: Why Defenders Need AI Too
AI agents are now finding zero-days, exploiting one-day vulnerabilities, and reshaping how offensive security works. Defenders relying on yesterday's tools are testing against yesterday's attackers.
READ THE ARTICLERedPick Scores 7/7 on HackMerlin
RedPick scored 7/7 on HackMerlin, bypassing a 4-layer LLM defense with a fully automated technique we call Cloze Filter Detection.
READ THE ARTICLE100% on PortSwigger Academy — 274 Labs + 5 Mystery
RedPick solved all 274 PortSwigger Web Security Academy labs available in April 2026, plus 5 mystery labs, across 31 categories, fully automated with no human intervention.
READ THE ARTICLEAgentic vs Automated: Why Traditional DAST Falls Short
There's a fundamental difference between automation and agency. This is what it means for application security, which vulnerabilities DAST will never find, and when traditional scanners still make sense.
READ THE ARTICLELLM Security Testing: The New Attack Surface
Your AI features are an attack surface. Prompt injection, jailbreaking, data exfiltration — here's the full OWASP LLM Top 10, what you need to test, and how RedPick approaches LLM security.
READ THE ARTICLE