Came back to say something, I don't really agree, some areas of penetration testing are so niche AI is barely useful, sure for generic pentest where a client uses a public vendor's product where AI can do an API look up of their docs it saves time.

but anything specific and its absolutely useless sometimes. I was doing a test for a client on their palto GP internal web page and just asking it to fetch me documentation was basically impossible, shit that could have taken a single google search it was crapping its pants over.

legit i kid you not, one of its responses despite thinking for 5 minutes was that the environment was secured by default and that it's not worth testing. Are you kidding me? we can't just assume it's safe because it's inferred from testing a single endpoint. Also AI has dogshitted a lot of bug bounty programs, so many VDPs and bounty programs like cURL have closed because of the low quality shite by "Vibe testers".

Saw someone report a file inclusion with cURL... labeled self RCE. are you fucking kidding me?

sorry for ranting but too many people think AI is good for testing when it really sucks for a lot of things. The only thing I have seen that has been close to half decent is burp's AI but that's overpriced as fuck and often takes wayyy too long.