CyberHacker.ai has launched its penetration testing platform to the public, opening it to any business that wants to attack its own systems before criminals do. Companies can now sign up on the company's website, add the websites, APIs or AI chatbots they want tested, and have autonomous AI agents start probing them within minutes, without a sales call or a weeks-long scoping process.

The pitch takes aim at one of security's oldest rituals: the annual pentest. In that model a company spends weeks scoping the work, books testers for a two-week window and receives a PDF weeks later, by which time its software has usually changed. CyberHacker.ai says its platform lets teams test whenever they ship instead. The details in this story come from the company's website; USA 24 has not independently tested the service.

How a self-serve AI pentest works

According to the company, a customer creates an account with a work email or a Google, Microsoft or LinkedIn login, then moves through four steps:

  1. Scope. Add domains, APIs and apps, pick a service and set the rules of engagement. Testing starts only after the customer's targets are verified.
  2. Test. AI agents map the attack surface, fingerprint the technology stack and try to exploit what they find, inside a window the customer books, from 2 to 72 hours or open-ended. Progress streams live to a dashboard.
  3. Triage. Engineers the company describes as OSCP- and CEH-level testers check every candidate finding before the customer sees it. Each one arrives with a severity rating, a proof of concept and fix instructions.
  4. Retest and certify. After a fix ships, the customer requests a retest. A finding closes only when the exploit no longer works, and the engagement ends with a certificate that customers, partners or auditors can check on the company's public verification page.

That last step is the company's main argument against traditional reports. "A finding that is never verified as fixed is just a note," its website says.

Agents that test AI systems, too

Four services run on the self-serve, AI-driven track: web application pentests, API pentests covering REST, GraphQL, WebSocket, SOAP and gRPC, a web vulnerability assessment, and a pentest for AI agents and chatbots.

The AI agent test is the most timely. Businesses are wiring chatbots and copilots into customer data, documents and internal tools, and every one of those connections can be abused. CyberHacker.ai says its agents try prompt injection, including instructions hidden in documents, emails and web pages the AI reads. They also attempt jailbreaks, extraction of system prompts, leaks from retrieval (RAG) knowledge bases, cross-user data exposure and unauthorized tool calls. The company says it tests against the OWASP Top 10 for large language model applications and covers agents built with frameworks such as LangChain, LlamaIndex, AutoGen and CrewAI.

Six more services are led by human experts and scoped for each customer: mobile apps, internal and external networks, operational technology such as SCADA and IoT systems, social engineering assessments run with written consent, and thick-client desktop software.

Built for teams that ship often

Tests can be bought one at a time or on a monthly plan that runs a fresh test every month, so teams that release new code often can test as often as they ship. Larger organizations with many apps or a full compliance program can have an engagement scoped for them.

CyberHacker.ai positions its reports as evidence for teams answering to SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR and the NIST Cybersecurity Framework. Its pitch rests on three things: testing that begins within minutes, a person checking every finding, and a retest-and-certificate step built into every engagement.

What to check before an AI agent attacks your systems

Whichever vendor you choose, letting software attack your infrastructure deserves the same care as hiring a human red team:

  • Authorization and scope. Only submit targets you own or control, and keep the rules of engagement in writing. With self-serve onboarding, you define the scope yourself.
  • Production or staging. Ask whether tests run against live systems, what safeguards prevent outages, and whether a staging copy can be tested instead.
  • Data handling. Ask what data the agents send to AI models, how long findings and any test credentials are kept, and who processes them. CyberHacker.ai publishes a list of its sub-processors.
  • Verification. Ask how findings are checked and what share turn out to be false positives. A proof of concept for every finding is the standard to hold vendors to.
  • The certificate. A pass covers the targets and the window that were tested, not your whole company. Read what it lists before you show it to customers.
  • Auditor acceptance. If you need the report for SOC 2 or PCI DSS, confirm with your auditor in advance that an AI-led test meets your requirements.
  • Liability. Check the terms for what happens if a test disrupts a system.

The stakes are real. Attackers are already exploiting edge devices and web apps at scale, as recent campaigns such as PEERSTITCH malware on FortiGate firewalls and the Nextcloud web shell flaw showed.

The bottom line

With its public launch, CyberHacker.ai is betting that many companies want security testing to work like any other online service. For small and midsize companies that have put off penetration testing because of cost and paperwork, a simple sign-up and a test that starts within minutes remove two of the biggest hurdles. Larger security teams may find the AI chatbot test the most useful piece, since few traditional pentests cover prompt injection and tool abuse. How well CyberHacker.ai's agents and reviewers actually perform will become clear as customers and independent testers put the platform through its paces.