Modern AI-Powered Pentesting Tools: In-Depth Benchmark
Escape, Tuesday, June 30th, 2026
A benchmark shows the engineering harness around AI models matters more than raw model capability for pentesting.
Antoine Carossio benchmarks AI-powered pentesting to test whether organizations should build solutions on frontier models or buy dedicated platforms. Escape's multi-agent system Cascade was compared against a raw model and competitors Aikido and XBOW.
On novel applications without public documentation, Cascade's harness produced roughly four times the yield of the bare model, which relied heavily on recall and generalized poorly to undocumented code.
Severity-weighted scoring proved more meaningful than raw finding counts, and black-box testing captured most high-severity issues. Cascade's advantages include multi-model orchestration, persistent context, authenticated multi-persona testing, and exploit validation.