Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

One September 2026 preprint reports fewer Critical findings when an AI-assisted penetration-testing harness used a decision layer to reassess evidence. But the test involved one run per setup against a local web app—not a cloud estate—and it does not show that AI agents generally downgrade high-severity cloud findings.

What the test found

Joas Antonio dos Santos Barbosa’s September 24, 2026 arXiv preprint describes NeuroSploit, an open-source Rust penetration-testing harness. Its initial case study tested NimbusCart, a localhost web application with 13 seeded vulnerabilities. The comparison was one run with Jev/TypeSafe enabled and one without it.

In that initial comparison, the run without TypeSafe hit 10 of 13 scenarios and reported five Critical findings. The TypeSafe run hit 9 of 13 scenarios and reported two Critical findings. Across both runs, the authors say 11 of the 13 scenarios were covered. The TypeSafe run took 26 minutes 53 seconds, compared with 32 minutes 12 seconds without it.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Those figures are observations from single runs, not stable performance estimates. The authors note that the runtime difference could reflect model-response variation, network latency or target load as well as the harness’s agent-pruning behavior. They also say the differences do not establish statistical significance.

#1 Best Overall
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified
  • POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
  • WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
  • FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
  • TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
  • BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.

Why some severity ratings went down—and others went up

The decision layer was intended to judge findings against collected evidence, rather than assume that a vulnerability class automatically proves a particular impact. In three examples, the authors say the system lowered Critical ratings to High because the evidence showed that an interpreter had been reached but did not show that data had been extracted.

Other findings moved in the opposite direction. Four findings had initially been rated Low because their structured evidence field was empty. After evidence was recovered from narrative text and exposed credentials or sensitive data, those findings were promoted to High. The process was therefore not a one-way severity reduction: ratings depended on what the harness could present as evidence.

Rank #2
Yubico - YubiKey 5C NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified - Protect Your Online Accounts
  • POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
  • WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
  • FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
  • MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
  • PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts

The BOLA example shows why evidence formatting matters

One reported broken object-level authorization (BOLA) flaw allowed a customer token to retrieve user records that included an administrator’s plaintext password and a live API key. The first TypeSafe pass scored the issue Low because its structured evidence field did not contain that proof. Once the evidence was copied from narrative text into the structured field, the data-type score recognized exposed secrets and the finding returned to Critical. The preprint’s full text describes this case.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

For a security team, the practical lesson is that a rating can reflect a gap in evidence capture as much as a gap in the underlying vulnerability. A decision layer cannot reliably assess impact if important proof is missing from the fields it evaluates.

Rank #3
Sale
Thetis Nano-A FIDO2 Security Key Hardware Passkey Device with USB Type A, TOTP/HOTP, FIDO2.0 Two Factor Authentication 2FA MFA, Works with Windows/mac/iOS/Android/Linux/Gmail/Facebook/GitHub/Coinbase
  • Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
  • USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
  • FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
  • Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
  • Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.

What the decision layer is designed to do

The paper describes four decision points for typed, non-generative models: adjudicating whether a finding is confirmed, needs review or should be rejected; recalibrating severity; pruning irrelevant agents; and triggering confirmation loops. Structured probability outputs are meant to help the harness route uncertain cases to human review and grade impact using demonstrated evidence.

This is evidence review within a penetration-testing workflow, not an AI agent independently verifying an organization’s security posture. The decision model does not itself prove that a vulnerability exists. The harness’s evidence, validators and routing rules remain important, and a human-review path matters when the result is uncertain.

Rank #4
Yubico - YubiKey 5 NFC - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-A or NFC, FIDO Certified - Protect Your Online Accounts
  • POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
  • WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
  • FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
  • MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
  • PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Why the later severity comparison is not a clean retest

The authors also report a separate retest after changing prompt-level chaining, evidence-field salvage and the data-type classifier. Its results were:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Setup Critical High Low Informational
Without TypeSafe 4 3 10 5
With TypeSafe 3 8 6 5

Because that retest changed both the decision layer and other parts of the harness, its distribution cannot be attributed to TypeSafe alone. It is not an isolated measurement of the AI layer’s effect.

Best Value
FIDO2 U2F Security Key Passkey Two-Factor Authentication (2FA) USB Key PIN+Touch (Non-Biometric) USB-C Type TrustKey T120
  • Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
  • Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
  • Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
  • Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
  • For the driver download and user guide, please visit TrustKey Solutions Home support page.

What this means for cloud security teams

The study does not establish a trend across cloud-security findings: it tested a local, seeded web app, not a representative production cloud environment. Its results are best read as an early example of how evidence-based adjudication might alter findings—not as proof that cloud alerts are routinely overstated or that adding an AI agent will reduce false positives.

  • Check whether a severity change follows from demonstrated impact, or from incomplete or differently formatted evidence.
  • Preserve proof in structured fields as well as narrative notes so the review layer can evaluate it.
  • Route uncertain findings to a qualified human rather than treating a model’s classification as validation.
  • Before relying on a measured reduction, test repeatedly with controlled conditions, alternating execution order and fixed seeds. The authors identify these as needed steps for stronger evaluation.
  • Account for possible false negatives, adversarially influenced evidence, calibration drift and context limits, all of which the paper flags as risks requiring further evaluation.

The initial comparison is exploratory, and the later retest is confounded by additional harness changes. Repeated, controlled evaluation on security-specific evidence is needed before drawing operational conclusions.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.