For the complete documentation index, see llms.txt. This page is also available as Markdown.

Smart Automated Testing

AI-driven API security testing that reasons, acts, and iterates to find vulnerabilities.

Smart Automated Testing is Akto's AI-powered testing mode where an intelligent agent takes over the execution of security tests. Rather than mechanically replaying pre-defined payloads, the agent reasons about each test, forms a plan, executes HTTP requests, observes the response, and refines its approach across multiple attempts — all to determine whether a vulnerability is real.

How It Works

The agent follows a Think → Plan → Act → Observe loop, repeating until it either confirms a vulnerability or exhausts its attempts. Each iteration builds on what the previous one learned.

Execution Loop

Step
What Happens

Thinking

The agent reads the test scenario and baseline request, then reasons about what a successful exploit would look like — which parameters to change, what response signals matter (status code, body similarity, error messages).

Plan (Attempt N)

Before sending a request, the agent decides exactly what to change and why — e.g., swap the auth token with a different user's token, alter an object ID, or craft a malformed payload.

Action (Attempt N)

The agent sends the crafted HTTP request. The full request is logged: method, URL, headers, and body.

Observation (Attempt N)

The agent reads the response — status code, body, headers — and judges whether it indicates a vulnerable or secure state. If the response is not conclusive, it adjusts and tries again.

Vulnerability Validation

After all attempts, the agent checks the key indicators defined in the test scenario — e.g., HTTP response code is 2XX, response body matches the baseline by more than 90%, no error message present. If criteria are met, the issue is flagged as confirmed.

How to Run Smart Automated Tests

Smart Automated Testing runs the same way as standard tests — you select the tests you want to run, and the AI agent executes them.

1

Open Testing

Go to Testing and open a collection or endpoint.

2

Select Tests

Click Run Test and select the tests by name or category.

3

Enable Smart Automated Testing

Check Smart Automated Testing in the test configuration panel.

4

Run

The agent references the selected test definitions and begins the execution loop.

The agent uses the test ID and its associated YAML definition to understand the scenario — what vulnerability to test for, what parameters to manipulate, and what response conditions confirm a finding.

Viewing the AI Execution Trace

Each Smart Automated Testing run produces a detailed AI Execution Trace visible in the test result. See AI Execution Trace in Test Results for details on reading the trace.

Key Differences from Standard Testing

Standard Testing
Smart Automated Testing

Execution

Fixed payload templates

AI-reasoned, adaptive requests

Attempts

Single pass

Multiple attempts, each improving on the last

Transparency

Request/response logs

Full reasoning trace (Thinking, Plan, Action, Observation)

Validation

Rule-based matchers

AI-driven judgment with evidence

Setup

Smart Automated Testing requires the AI Automated Testing agent running alongside your hybrid testing module. See Set Up Smart Automated Testing for installation and configuration.

Get Support for your Akto setup

There are multiple ways to request support from Akto. We are 24x7 available on the following:

  1. In-app intercom support — message us inside the Akto dashboard and someone will reply.

  2. Join our discord channel for community support.

  3. Contact help@akto.io for email support.

  4. Reach us here.

Last updated