What the Red Team Demos Don't Show You

A real overnight run produced 41 findings. Eleven were real, thirty were invented, and three targets were touched that should never have been touched. Here is how to run an autonomous agent so that arithmetic works for you.

Date: 2026-08-10 | Classification: TLP:CLEAR

Why this matters. Stop asking whether your agent is capable enough. Ask whether anything in the loop can verify its output, because that single property decides whether autonomy compounds or manufactures confident fiction.

The Operator's Take

I wrote this in June, and one number in it has aged strangely. Thirty of forty-one findings hallucinated is still what I see on a noisy target. But in July OpenAI's own models, running unattended, found a genuine zero-day in a package registry proxy and chained it into a real compromise of a real company, with no human connecting the pieces.

Both of those are true, and what separates them is not model quality. It is whether the agent can check its own answer. OpenAI's models were chasing a benchmark that told them when they had won, so every wrong path was cheap and self-correcting. My red team agent chases a fuzzy goal against a target where nothing scores itself, so a wrong path looks exactly like a right one and gets written up as a finding.

That is the dividing line, and it is more useful than "breadth versus insight". Where a machine can verify the result, autonomy compounds. Where only a human can, you get confident fiction at scale. Everything below still holds, and that sentence is why it holds.

What This Is

A field report on what actually happens when you turn an autonomous agent loose and walk away, rather than what happens in the demo.
The claim: an autonomous agent is a force multiplier for the operator and not a replacement, and anyone selling it as a replacement has not run one to completion.
The number that matters: on a realistic overnight run, 11 of 41 findings were real. Verification, not generation, is where the work went.
The mental model to steal: the agent is the most tireless junior on the team, with infinite stamina for wide and boring work, zero instinct for what matters, and a habit of confidently making things up.
The property that decides everything: whether anything in the loop can tell output from observation.
This generalizes. Swap "findings" for tickets auto-resolved or rows transformed and the same gap opens under your agent.

Why the demo always works and your run doesn't

Every agent demo is a magic trick, and the trick is editing. This is not specific to security. Watch any product video where an agent refactors a codebase or books a trip end to end. You see the one clean take. You do not see the eleven prior runs that wandered off, the time the agent picked the wrong file, the human who pre-arranged the inputs so the path was smooth. You do not see the cost meter.

The honest version is messier, and it is messier the same way for every autonomous agent. It does real work, but it also stalls, loops, and lies with a straight face. A coding agent confidently fixes a bug by editing a file that never runs. My red team agent reports a database injection on an endpoint with no database behind it, and declares a port open that a second check shows closed.

The demo cuts that out because watching someone verify output is boring, and boring does not sell seats. So internalize this first: the demo is the best run out of many. Your nightly run is the average one. Plan for the average.

Where the agent genuinely earns its keep

Let me be fair to the machine, because it deserves it. There is one shape of task where an autonomous agent is not just helpful, it is better than the person, and the shape is the same across every domain: work that is wide, mechanical and dull, where breadth and patience matter more than insight.

What it is great at	My version	Your version
Enumeration	Subdomains, certificate transparency logs, every JavaScript bundle, every route, cross-referenced without getting bored on the fortieth host	Any "go look at all of it" job: reading every ticket to tag themes, profiling every column in a warehouse
Tireless iteration	A fuzzing or parameter-discovery task I would babysit for an hour, run for six while I sleep	A coding agent grinding through a thousand test failures, a migration agent touching every file in a monorepo
Generation and variation	Forty injection strings tuned to a specific filter, faster than I can think of ten	Forty subject lines, edge-case test inputs, a pretext rewritten for a different audience

I get bored on the eighth host. The agent does not. Breadth is its native gift.

Here is the part people miss. None of that is the agent replacing the operator. All of it is the agent doing the parts of the job that are mechanical, wide and dull. That is the whole value, and it holds whether the operator is a pentester or a support lead. It clears the underbrush so a human can spend attention on the thing only a human can do.

Where the human still wins, decisively

Read the principle under each of these: the agent sees surface, not intent, and it sees pieces, not the story they tell together.

Where it fails	Why	The mundane twin
Creative pivots	The best findings come from noticing two unrelated things that together break an assumption nobody wrote down. The agent finds each piece and almost never connects them	A support agent summarizes two tickets perfectly and never realizes they describe one customer being double-billed
Logic the surface doesn't show	It will hammer a checkout's inputs. It will not think to add a negative quantity for a credit, or race two requests to redeem one coupon twice	A refund agent follows the literal policy text and misses that the policy, in this edge case, hands the customer free money
Judgment on what matters	Its confidence is not calibrated to your stakes. Severity is a business question wearing a technical costume, and the agent does not attend the business	A triage agent flags the loud cosmetic issue and shrugs past the quiet one that actually costs you
Knowing a finding is real	It cannot reliably tell a thing it found from a thing it generated	Every agent you will ever ship

That last one is the load-bearing wall of the entire engagement. Telling output from observation is the capability the agent does not have and you do.

The unglamorous parts nobody puts on a slide

Each of these is a tax you pay no matter what the agent is pointed at. Mine just has the highest penalty for skipping it.

You babysit it. An agent left fully alone will wander. Mine will rabbit-hole on a dead endpoint for an hour, or decide the most interesting thing on the target is the cookie banner. Yours will too. The autonomy is real, but it is autonomy that needs a leash and a handler.

You verify everything. Thirty of forty-one hallucinated is not exaggeration for effect, it is roughly what a noisy target produces. Every finding gets reproduced by hand before it goes in a report, because a single hallucinated critical discredits every real finding sitting next to it. Verification is not a step at the end. For any agent worth trusting, it is most of the work.

It costs real money, and probably not where you think. Everyone asks about the token bill. The token bill is the cheap part. Below is what an overnight run actually costs, and the surprise is which line dominates.

Scope discipline is on you, always. An autonomous agent with real tools and a fuzzy goal can reach out and touch something it was never authorized to touch. For a billing agent that is refunding the wrong account. For me it is scanning a host that was never in the engagement, and out of scope is one ambiguous instruction away. The agent has no instinct for the boundary, legal or ethical. Put the boundary in code behind a named control gate with an allowlist, because a boundary that lives in your vigilance fails the night you are tired.

A realistic overnight run

The 41 findings the agent reported split cleanly in two:

The 41 findings	Count
Reproduced and real	11
Hallucinated, not reproducible	30

Three other things happened in the same run, none of them part of that 41:

Also in that run	Count
Out-of-scope targets touched	3, caught, killed and logged
Genuinely novel findings from the agent	0, those came the next day, from me
Hours of my time spent verifying	about 5

What that run costs, in money

People assume AI is nearly free and the babysitting is the cheap part. It is the other way round, and the arithmetic is worth doing once.

This is an illustrative model, not a measurement of my run. The rates are Anthropic's published list prices; the volumes are my assumptions, stated so you can substitute your own. Assume a six hour unattended run consuming 30 million input tokens (an agentic loop resends its history every turn, so the input side dominates), of which 90% are served from cache at roughly a tenth of the input rate, plus 1.5 million output tokens.

Model	Input / output per 1M	Cached input	Fresh input	Output	Run total
Claude Opus 5	$5 / $25	$13.50	$15.00	$37.50	about $66
Claude Sonnet 5	$3 / $15	$8.10	$9.00	$22.50	about $40
Claude Haiku 4.5	$1 / $5	$2.70	$3.00	$7.50	about $13

Now price the other line. Five hours of a senior security operator, at any loaded rate you consider realistic, lands somewhere between $375 and $750. Even on the most expensive model in that table, the human verification costs roughly seven times the compute that produced the work.

You are watching the wrong line item

Every cost conversation I hear is about tokens. Tokens are a rounding error next to the verification they create.

Look at what actually drives that five hours: thirty findings that had to be chased down and thrown away. The reproduce rate is not just an accuracy statistic, it is the term that sets your largest cost. Move it from 27% to 54% and you cut roughly two and a half hours of senior time, saving several hundred dollars against a token bill of sixty six.

Which is the whole argument of this post, arriving from the accounting side: spend your effort on what can verify the agent's output, not on making the agent cheaper. A cheaper model that hallucinates at the same rate saves you fifty dollars and costs you the same five hours.

The token discipline still matters, just for a different reason than people think: a run that loops badly can spend all night producing nothing, and you learn to cap, checkpoint, and kill a run that is clearly spinning. That is waste avoidance, not cost control.

That is not a failure. That is a successful run. Eleven real findings I did not have to enumerate by hand is a strong night. But notice the shape, because the shape is universal: the agent did the breadth, the human did the truth. Draw the same table for your own agent with "tickets auto-resolved" in the top row and "actually correct" two lines down, and the gap between those numbers is the supervision your build needs and the demo never showed you.

The number that should change how you buy

When a real campaign was measured rather than demoed, the autonomous runs scored zero. Every confirmed compromise in Unit 42's analysis of the knaithe operation came from the human working by hand, and all seven CVEs involved were public and already patched.

Hold that against the vendor pitch. You are not being sold a capability that does not exist, you are being sold a capability whose success rate nobody quotes. Ask any agentic red team vendor for the reproduce rate, not the finding count. If they quote you findings per night, they are quoting you the top row of my table and hoping you do not ask for the second.

So is it a replacement, or not?

A force multiplier for the operator, not a replacement for one. You would not hand the tireless junior an unsupervised job and the authority to act on it. You would point them at the mechanical work, check everything they bring back, and do the thinking yourself.

Run it that way and your output goes up sharply. The work that cost a day costs an hour. The thorough pass you used to skip out of fatigue gets done in full. Your attention, the scarce thing, lands on the judgment work where you are irreplaceable. The agent is not better than you. The agent plus you is better than you alone, and that is the entire game.

Run it the demo way and you get the other ending. For most teams that is mundane and expensive: a wave of tickets auto-resolved with confident wrong answers, or a pipeline that fills a quarter of your dataset with plausible fabrications nobody catches until a dashboard lies to an executive. For me it is sharper edged: publish the hallucinations, or scan something I was never allowed to touch. Same root cause, different blast radius.

The property that makes the agent powerful, the self-closing loop, is the same one that gets you in trouble the second you stop watching it. Close that loop with a verifier the machine can run and it works for you. Leave the verifier as a human afterthought and it manufactures work.

What To Do

Before the next run

Write down what would make each finding verifiable by a machine, before you start. If nothing in the loop can score the agent's answer, plan for a hallucination rate near what I see and budget the verification hours honestly.
Put scope in code, not in the prompt. A named control gate with an allowlist survives an ambiguous instruction; a sentence asking the agent to stay in scope does not.
Set a token cap and a wall-clock kill for the run. A loop that spins overnight costs real money and produces nothing.

On the output

Reproduce every finding by hand before it reaches a report or a customer. Treat the agent's confidence as unrelated to truth, because it is.
Track your own reproduce rate over time as a number. It is the single metric that tells you whether the agent is helping or generating work.
Cost the verification hours, not just the token bill, and put both in the same table. If you only report tokens to your finance team you are reporting the smaller number by roughly an order of magnitude.
Rank findings yourself. Severity is a business question, and the agent does not attend the business.

When buying agentic tooling

Ask the vendor for the reproduce rate and the out-of-scope incident count, not the findings-per-night number.
Ask what the agent can verify on its own. If the honest answer is nothing, you are buying breadth, which is worth real money, and not judgment, which is not on offer.