Research Article
An AI Agent–Driven Automated Web Vulnerability Scanning Framework
@INPROCEEDINGS{10.1007/978-3-032-34048-1_1, author={Kuan-Jung Chen and Zong-Jie Wu and Syu-Bo Jhang and Lun-Ping Hung and Chien-Liang Chen}, title={An AI Agent--Driven Automated Web Vulnerability Scanning Framework}, proceedings={Smart Grid and Internet of Things. 9th EAI International Conference, SGIoT 2025, Taichung, Taiwan, December 6--7, 2025, Proceedings}, proceedings_a={SGIOT}, year={2026}, month={10}, keywords={Ai Agent Large Language Model Cybersecurity}, doi={10.1007/978-3-032-34048-1_1} }- Kuan-Jung Chen
Zong-Jie Wu
Syu-Bo Jhang
Lun-Ping Hung
Chien-Liang Chen
Year: 2026
An AI Agent–Driven Automated Web Vulnerability Scanning Framework
SGIOT
Springer
DOI: 10.1007/978-3-032-34048-1_1
Abstract
As web application architectures grow more complex and dynamic content becomes increasingly prevalent, both traditional static scanners and manual penetration tests suffer from high vulnerability‑miss rates and low efficiency. This paper presents an AI‑Agent‑based automated scanning methodology that integrates two core components—the Orchestrator and the Intruder LLM—into a fully closed‑loop workflow of requirement analysis, strategic decision‑making, Docker‑containerized execution, feedback processing, and report generation. Deployed on Ubuntu 22.04 LTS and powered by Llama 3.2 1B for inference, the system was evaluated on 51 test cases drawn from DVWA, WebGoat, and bWAPP, achieving an overall detection rate of 0.88. By dramatically reducing manual effort, this approach paves the way for future enhancements—such as automated endpoint crawling and larger‑context language models—to further improve vulnerability detection accuracy and coverage.