Integrated Security: Pen-testing by One Agent, Fixing by Another

[Juice10]

What: One specialized AI agent attempts to penetrate or break the app, while another agent (or the same one in a different mode) fixes any vulnerabilities.
Why: Helps developers catch security flaws early and reduce manual pen-testing overhead.
Questions:
How do we scope the pentest agent’s access so it doesn’t disrupt production?
Are there known best practices or frameworks for AI-driven pentesting?
Could an AI accidentally introduce new vulnerabilities while fixing old ones?
Let’s pool thoughts on building a security pipeline that uses AI to hunt vulnerabilities and automatically repair them.