Autonomous, never unaccountable:
the controls around an AI pentest.
Published 2026-09-11 · Updated 2026-09-13
R0 is valuable because it acts on its own. It is safe because every action is bounded, reversible on command, and written to an append-only ledger you can replay step by step — so you can turn it loose without turning off the controls.
Is autonomous penetration testing safe to run in production?
Yes, when it is bounded the way R0 is. R0 is non-destructive by default and refuses anything outside your written rules of engagement: a strict scope guard allow-lists every host before a tool touches it, SSRF and anti-loop guards keep a run from wandering or hammering, and an operator can halt the whole run — or a single subagent — instantly with the kill switch. Higher-impact actions run only behind an approval gate, and every step is written to an append-only ledger you can replay, so a safe autonomous test is also a fully accountable one.
Strict scope guard
Every host a tool would touch is validated against an allowlist before the call runs. Auto-expansion is bounded to the target’s own registrable domain — nothing wanders.
Non-destructive by design
Testing is built to probe and prove, not to break. Passive-URL SSRF guards, anti-loop controls and rate limits keep the run from harming what it assesses.
Kill switch & gates
Halt the whole run — or a single subagent — instantly. Optional human-in-the-loop gates can require approval before higher-impact actions.
Authorised-only
R0 runs against defined rules of engagement. Scope, timeframe and target set are explicit, and out-of-scope hosts are refused, not merely deprioritised.
An append-only ledger of everything it did.
Every tool call, script, scope decision and finding is written to an immutable log with its inputs, outputs and timestamp. You can replay a run end to end, see exactly why a subagent did what it did, and re-run any step deterministically. Nothing the AI does is a black box.
Every finding ships proof.
CVSS 3.1 vector
Severity derived from a score, not a vibe — a defensible vector on every finding.
Reproducible steps
Exact requests and commands to reproduce, captured as the run happens.
Blue-team ready
Each step maps to the detection opportunity your SOC should have fired on.
See R0 run against
a target of yours.
A continuous, autonomous red team on hardware you own — no data ever leaves the box.