Every run of our attacker agent leaves a footprint: attack traces, user verdicts, and the cost of each step. Most teams keep it as a log. We use it to make the next run better.
Some lessons come from humans: users label signals and grade what the agent learned. Others come from the system itself: it reads its traces and costs. Humans teach. The system learns. Both feed one loop.
Most AI offensive security results report recall on lab sets that the vendor picks: can the agent find a planted vulnerability? Customers live with a different question: how often is the agent wrong on their app, and does it learn when it is? That is precision on production, labeled by users. A lab score cannot show it, and a better model alone cannot fix it.
The loop
Observability shows where the agent fails. Continual learning turns that into a change. Evaluation proves the change before it ships. Then production shows the effect, and the loop starts again. Miss the last arrow and you have a log, not a loop.
We rent the model, and it changes every few weeks. The harness (tools, sub-agents, skills, prompts) is ours. What production teaches us lives above both, outside the model, so it survives a model swap. No new weights needed.
Observability: see
We watch our attack agents, and one key signal is the false positive. When a user overturns a finding, we do not just delete it. A classifier reads the user's feedback and proposes why the agent was wrong. The user's verdict stays the ground truth. Each reason goes to a different fix.
The result is not one accuracy number. It is a ranked list of why the agent was wrong. A false positive you can name is a bug you can close. One you delete comes back next week.
Continual learning: change
An expert told our agent: “This is not a vulnerability. The endpoint is admin-only by design.” The next week, a new run made the same mistake. Every run started from zero.
Now each failure mode goes to one action. A fact about the app becomes a memory that the next run reads. A bug in the agent becomes a ticket. Not every mistake should become a memory. Our earlier post has the details.
Runs also learn without feedback. After each attack, a learner reads the trace and can save learned lessons.
We measure each memory: we compare runs that read it with runs that did not, against the human verdict. Users also grade sampled new memories, and we use those grades to tune how the agent learns.
Evaluation: gate
Every user's verdict can become a test case, including misses. When observability shows an interesting case or a new mistake in production, we add it to the dataset. Our production failures are our most honest benchmark, and we already labeled them.
We run the real agent with different configurations. Each configuration changes one slot: the model, the prompt, the tools, the reasoning effort, or a skill. A configuration wins only with enough samples, a clear gain, and confidence intervals that do not overlap. If not, the answer is "inconclusive."
The first problem the gate found was ours. Our verdict stage was an agreeable judge: it confirmed most of the signals that users had rejected. After four skill versions, precision was up about 19% and recall about 12%, at the same cost.
The gate also lets us choose a model for each slot inside the agent, not one preset for the whole test, and judge each choice on user-labeled data. A cheaper model is easy to find. The hard part is knowing what it costs you in precision on your own production data. A lower-cost open-weight model cut verdict cost by 74% with the same precision. In production, cost per verdict on our main attack slots went down by about 70%.
The 100th run
See, change, gate, repeat. The loop, not the model, makes the agent better over time. The 100th run should be worth more than the first.
