↓ Skip to main content
Elliot Belt

Blue-Team

Credential-Blind Agentic Pentesting — Part I: Bidirectional Tokenization of Secrets, Identities and Topology

·20 mins
AI Security Research Red Team Agentic Llm Ai Red-Team Blue-Team Secret-Management Credential-Blind Tokenization Privacy Pentest Active Directory Provider-Agnostic Research
I want an AI agent that can do offensive and defensive security work without ever leaking a credential, a hostname, an IP or a domain to the model provider, and to keep that property no matter which provider sits behind the API. This is Part I of the research. It covers the threat model, the state of the art, the core mechanism (bidirectional tokenization with host-side resolution), and four experiments that run on real HackTheBox machines, including an autonomous agent that drives a real domain controller while seeing nothing but opaque tokens.