Uncensored AI Pentesting Still Needs an Independent Scope Boundary
An internal DeepSeek evaluation separates exploit capability from operational restraint. Define scope, evidence and cleanup before autonomous testing.
Beyond ASPM
Proof-Driven AppSec for teams building with AI
Plexicus uses AI Swarm Pentest to explore authorized application paths, validate what is exploitable, and give teams evidence they can use to prioritize remediation.
Explore AI Swarm PentestA penetration-testing agent can complete a technical objective while exceeding the permission that made the test legitimate. Model selection therefore needs two acceptance criteria: the quality of the finding and the behavior used to obtain it. Removing refusals does not answer the second question.
What the experiment establishes
In its October 27 internal evaluation, MindFort tested an uncensored DeepSeek build on its own deliberately vulnerable applications, in isolated environments. It reported safety-check intervention rates of 7.2% for the uncensored build and 2.5% for standard 1017; outright blocks were 6.1% and 1.1%, respectively. Neither build refused authorized tasks. These are action-level observations from that evaluation, not attack-success rates or production guarantees.
MindFort also reported persistence and disruption in its test environment. It had not run standard 1017 against the same target used for part of its exploit-depth comparison. The report therefore does not establish that removing refusals improves vulnerability discovery.
The Dealign AI model card describes a third-party weight modification. It is not an official uncensored release from DeepSeek, and the evaluation does not establish that its checkpoint is identical to that repository. Keep those provenance records separate.
Put authorization outside the agent
A scope document is useful only if the execution system can enforce it. For an authorized test, define the following before the first action:
| Boundary | Acceptance condition |
|---|---|
| Target | Explicit application, account and network allowlist |
| Action | Permitted operations and an independent approval path for exceptions |
| Evidence | Minimum reproducible proof, with a stopping condition |
| Recovery | Named owner, reversible test state and cleanup verification |
This is a proposed engineering checklist, not a claim about a control implemented in the evaluated system. Check the destination and effect of each proposed operation, including redirects and calls to adjacent services. A goal such as “verify authorization” does not authorize creating persistent accounts or modifying unrelated systems.
Make findings reviewable
The OWASP testing guide recommends tailoring testing to application context and combining automation with investigation and verification. Apply that principle to agent output: preserve the authorized request, the observed behavior, the affected code and the minimal evidence needed to reproduce the issue.
Plexicus AI Swarm Pentest describes evidence-backed validation across authorized applications, APIs and source code. Use remediation to turn validated application findings into reviewable fixes. Those product workflows are not a blanket assurance that any downloaded model is contained; evaluate the actual configuration and scope controls of the system you deploy.
Before approving a run as complete, review both the finding and the test’s residual effects. A technically valid result does not erase an unauthorized change. Explore Plexicus AI Swarm Pentest and ask what evidence your team will retain for validation, remediation and cleanup.
Model provenance reference: Based on the Dealign AI model card linked above. The thumbnail uses its original repository mascot under the repository’s MIT license; this does not imply endorsement or establish the identity of MindFort’s evaluated checkpoint.
