What happened
Cobalt launched (July 22, 2026) Autonomous Pentest, which runs AI-driven offensive-security testing (reconnaissance, tool chaining, exploitation) across an entire application portfolio with a Cobalt pentester scoping, overseeing and authorizing each engagement; findings delivered within 24 hours, built on 13 years of pentest data and a model-agnostic engine.
Why it matters
Addresses the widening gap between AI-accelerated software shipping/attacker automation and finite pentest budgets by scaling coverage to full portfolios while keeping human accountability for scope and validation — directly citing the Hugging Face autonomous-agent breach as the threat model driving demand.
Applicability
Security leaders with large, only-partially-tested application portfolios should evaluate for continuous coverage of previously untested lower-priority apps.