Agentic Attack Surface Recon: A Real Case Study From 497 Scans

Start with the shape of the corpus, not the marketing number. 497 completed jobs against 311 unique domains is a jobs-to-domain ratio of about 1.6. That means the dump is not pure one-domain-one-scan noise. A meaningful share of surface got more than one pass. At the same time, 311 domains in roughly three months is broad enough that no single vertical can dominate the finding climate. When leakage hits 88% of long reports, that is not “we scanned the same broken lab box forever.”

Report coverage is also high: 487 AI executive reports on 497 completed jobs. Only a thin slice of completed work failed to produce a narrative layer. Average length around 4,700 characters is long enough for an executive brief and short enough to reuse in a ticket or bounty note. The max at 11,028 characters shows the synthesizer will expand when the evidence pile is thick, instead of truncating every target into the same bland paragraph.

Shareable jobs are 67 of 497, about 13.5%. That is useful context for anyone judging SquidScan from public screenshots alone. Most production signal never leaves the operator’s private context. Public demos will always under-sample the real distribution.

HackerOne scope sync at 1,778 programs is a different kind of volume metric. It is not scan count. It is workflow gravity. Scope tables that large only appear when bounty-oriented operators treat program boundaries as machine-readable input, not a PDF they re-read every Monday.

Task outcomes are the least glamorous table in the dump and the most important one if you build or buy agentic recon. Out of 23,039 tool tasks: 21,440 completed, 1,514 cancelled, 85 failed. Completion sits near 93.1%. Cancellation is about 6.6%. Hard failure is about 0.37%.

That cancel-to-fail ratio is the tell. Cancels outnumber hard fails by roughly 17.8 to 1. In multi-tool pipelines, a sick architecture usually dies in cascades: parser break, retries storm, downstream agents starve, half the graph goes red. That is not what this distribution looks like. This looks like operators and schedulers stopping work on purpose, plus targets that were gone, firewalled, or timed out cleanly.

Put the failure count next to pipeline width. A 45-agent design that only hard-failed 85 times across more than twenty-three thousand invocations is not “never breaks.” It is “breakage is not the default state.” For capacity planning, the operational tax is mostly cancel/timeout handling and target quality, not constant incident response on the orchestrator.

Also notice what reliability enables downstream. You only get trustworthy finding frequencies and AI report stats if the machine actually finishes enough stages to feed them. A pretty synthesizer on top of a 60% task completion rate is fiction with good grammar. A 93% completion rate is what makes the later climate charts worth reading.

Duration stats only make sense as a distribution. Minimum 8 minutes, median 33 minutes, mean about 75 minutes, maximum beyond 20 hours. The mean is more than double the median. That is a classic right-skew fingerprint: most mass is moderate, a minority of monsters pull the average up hard.

Operationally, those are two different planning numbers. If you staff humans against the mean, you over-budget ordinary targets and still get surprised by the tail. If you staff only against the median, the giant subdomain programs will blow your calendar. The production read is: quote ~30-40 minutes as typical wall-clock for a full pass, and keep explicit overflow policy for fat-tail assets with huge DNS graphs or deep content discovery.

The floor matters too. An 8-minute minimum says the pipeline can stay short when the surface is small. It is not a fixed “always run for two hours” product. That elasticity is what you want from agents on rails: spend compute where the map expands, stop spending when it does not.

The extreme tail (20+ hours) should not be read as average pain. It should be read as proof the system will keep walking a large program instead of pretending a 4,000-host bounty surface equals a brochure site. Whether any single 20-hour run is “worth it” is an operator judgment. The important corpus fact is that long runs are possible without being the center of the distribution.

The production tool mix is not a random bag of GitHub stars. It clusters into a deliberate kill chain that mirrors how strong human recon crews already work.

Map first. subfinder, findomain, dnsx, dnsrecon, fierce, wayback, theharvester, and github_dork expand the world before anything noisy happens. If this layer is weak, every later “finding” is cosplay on an incomplete host list.

Expand second. katana, ffuf, feroxbuster, gobuster, and arjun turn hosts into content and parameters. This is where runtime grows on big targets, and it is also where a lot of leakage, admin paths, and redirect candidates are born.

Probe third. httpx, nuclei, nikto, testssl, known_exploits, cors_scanner, ssrf_scanner, wordpress, jwt_oauth_analyzer, and ssti_detector spend active checks where the map justifies cost. This is also where version-aware CVE logic and class-specific testers live.

Context last. package_registry, dockerhub, public_leak, waf_whatweb, enum4linux_ng, and github_repo_search attach supply-chain and exposure context that pure HTTP crawlers miss.

The architectural point is ordering and containment. AI synthesis sits on top of collected evidence. It does not replace collection. That is why report language can talk about SSRF surfaces and takeover candidates at high rates without requiring the model to invent hosts out of vibes. The agents built the graph. The model narrated it.

The 120-report sample is stratified long-form output (roughly 800+ characters), so it is biased toward runs that produced enough evidence to narrate. That is a feature for climate analysis. Short empty reports would dilute every rate toward zero and hide what the pipeline says when it actually has material.

Read the rates as co-occurrence of themes in narrative, not as confirmed CVSS scores. Leakage at 88% and HSTS at 88% means those topics are nearly ambient in long reports. SSRF surface discussion at 81% and secret-exposure language at 79% say the synthesizer is not only complaining about headers. It is regularly connecting content discovery and service behavior to higher-impact classes. CSP at 76%, takeover candidates at 68%, open redirects at 62%, and X-Frame-Options at 61% round out a top tier that is almost entirely “external posture and abuse primitives,” not exotic memory corruption.

High/critical severity language in 96-98% of long reports needs careful interpretation. It does not mean 96% of companies were one click from ruin. It means that once a report is long enough to analyze, the model almost always elevates at least one item into strong severity vocabulary. The useful analyst move is to ignore the panic index and watch which classes keep earning that vocabulary: leakage, transport/header policy, SSRF, secrets, takeover.

Stack that against hunter behavior. Experienced operators already open with those classes on day one. The corpus is quantitative permission to stop treating basics as beneath the tool. The median internet still fails basics often enough that a serious pipeline will sound repetitive if it is honest.

Technology frequencies rewrite the mental model of “default external target.” GraphQL appears in 58% of the long-report sample. CORS misconfiguration talk appears in 55%. Those two alone say the modern perimeter is an API and browser-trust problem as much as a CMS problem.

WordPress at 38% is still large. It is not the monoculture story from a decade ago. Cloudflare at 36% means edge/WAF presence is common enough that recon tooling has to behave like something that will meet bot defenses and cached edges routinely. XSS-related findings at 36% keep injection in the conversation without making it the only story. AWS/S3/CloudFront signals in the 25-39% band show cloud object and CDN footprint is a regular character, not a rare boss fight.

Lower but real: Nginx around 17%, Next.js/Node patterns 14-19%. Those are not “ignore” numbers. They are “do not build your entire identity around them” numbers. The center of gravity is API mesh + cloud edge + uneven browser policy, with classic CMS and server fingerprints still contributing a solid minority.

There is an interaction with the finding climate. High CORS talk plus high GraphQL rates is exactly the environment where authz mistakes, cache issues, and cross-origin confusion show up in real bounty programs. High Cloudflare rates also explain why naive scanners that cannot handle edge friction look worse than their checklists suggest.

73 CVE Confirmed awards across 497 completed jobs is about 0.15 confirmed-award events per completed job if you naively divide. That arithmetic is crude, but directionally useful: confirmed version-matched CVE hits are present and real, not omnipresent. The pipeline is not trying to pin a CVE poster to every domain.

Qualitative review of the long reports matters more than the raw count. The CVE identifiers that showed up most often were older or configuration-dependent issues. Fresh remote code execution zero-days were not the center of gravity. That matches a Known Exploits phase built around version awareness and exploitability caveats instead of banner-grab bingo.

The hedging language is part of the security product, not a soft personality quirk. Lines like “only relevant if the installed version is affected” and “exploitability depends on specific configuration” reduce the classic multi-tool failure mode: dumping every CVE that ever touched a product family and forcing humans to delete fiction. In a world where AI can make bad claims sound confident, restraint is a feature you can measure in fewer, better awards.

Connect this back to the finding climate. Headers, leakage, SSRF surfaces, and takeover candidates dominate narrative frequency. CVEs are a sharper, rarer blade in the same toolkit. That is healthy. A corpus where CVE wallpaper outran basic posture would suggest the wrong incentives.

Header hygiene is the strongest “always on” signal class in the climate data. HSTS discussion at 88%, CSP issues at 76%, X-Frame-Options at 61%, plus recurring Referrer-Policy, Permissions-Policy, and COOP/COEP/CORP weakness, add up to a simple fact: transport and browser-policy debt is still the external internet’s unfinished checklist.

These findings are easy to mock because any one of them rarely reads like a Hollywood breach. That mockery is how programs stay messy. Headers are high-frequency, low-glamour controls that interact with everything else you care about: cookie trust, click risk, script injection blast radius, and whether HTTPS policy actually sticks. When they are missing in aggregate, they are not trivia. They are posture.

They also serve a measurement role inside an agentic pipeline. On hardened or simple targets, residual header and disclosure notes are proof the sensors executed and still found something legible. On messy targets, headers are step one in a ladder that climbs into leakage, SSRF, redirects, takeovers, and version-matched component risk. If header checks go silent while other agents claim drama, you should distrust the drama.

That is why the triage order suggested by the corpus is deliberately boring:

1. Transport and header policy
2. Public leakage and secret exposure risk
3. SSRF and open redirect surfaces
4. Takeover candidates
5. Version-matched component risk
6. Deeper app-specific paths (GraphQL, auth, XSS classes)

Operational tables answer a different question than finding rates: what did people actually do with the system?

Badge mass clustered on SSRF indicators, logging/monitoring gaps, public leak indicators, security misconfiguration, and missing cross-origin headers. That distribution is not random gamification noise. It lines up tightly with the AI report climate. When awards and narratives point at the same classes, two things are true at once: the pipeline keeps finding those classes, and operators keep recognizing them as worth collecting. That is a healthy feedback loop. A broken one would show badges peaking on novelty cosplay while reports quietly fill with headers and leakage.

Scope sync is the second behavioral signal. 1,778 HackerOne programs in scope tables is not a toy integration. Bounty work has a hidden tax: hours lost re-deriving what is in scope, out of scope, wildcarded, or explicitly excluded. Machine-readable scope turns that tax into setup instead of folklore. Heavy sync volume means at least some power workflows are already there.

Schedules are the gap. Only a handful of recurring schedules existed by the end of the window. Most usage remains one-off or ad-hoc. That single fact caps what this corpus can claim. We can describe one-shot recon climate with confidence. We cannot yet publish week-over-week attack-surface drift at scale, because the longitudinal spine is still thin.

Shareable job count (67) reinforces another behavioral truth: people run this for private work more than for public flex. Product intuition that overfits to shareable screenshots will miss how the tool is used on ordinary Tuesdays.

Once you stop counting tools and start reading documents, the AI layer has a clear production personality.

Structure is standardized. Most long reports walk the same spine: executive summary, critical findings, medium/low findings, recommendations. That sounds boring until you watch operators work. People paste. Clients skim. Bounty write-ups need a clean critical section. A stable skeleton beats a clever new format every Tuesday. Consistency is what makes 487 reports interoperable with human workflows.

Length is elastic but bounded. Average ~4,700 characters is a usable brief. Maximum 11,028 shows the system will spend more words when evidence density rises, instead of always emitting the same padded essay. That elasticity matters. Fixed-length generators either starve complex targets or drown simple ones.

Tone hedges under uncertainty. Low-confidence items get qualified. Manual validation gets requested. In offensive security, that is not weakness. An agent that never hedges eventually lies with perfect grammar, and humans learn to ignore it. Measured tone is how trust compounds across hundreds of reports.

Hardened targets still produce residual signal. Self-scans and deliberately low-risk targets still surface missing headers, information disclosure, and configuration notes. That answers a quiet product fear: does the pipeline go mute when there is no cinematic bug? In this corpus, no. “No criticals” is not “no signal.”

High-signal findings exist and remain the minority. Exposed admin interfaces, outdated software with known critical CVEs, misconfigured cloud storage indicators, and clear takeover candidates appear often enough to matter and rarely enough to stay special. The shape is a pyramid: broad posture debt at the base, serious exposure in a smaller top.

Every quantitative security write-up tries to sound final. This one should not.

Schedules are rare, so drift is mostly unmeasured. One-shot climate is solid. Continuous attack-surface intelligence needs recurring observation. Until schedules thicken, week-over-week deltas would be storytelling on thin ice.

Three months is young. Seasonal effects, product changes, and target-mix shifts can move rates. Treat percentages as current climate, not eternal law. Re-run the study after the next major agent or correlation change before you carve the numbers into a keynote.

Human false-positive rates are not in the dump. We can count what agents emitted and what the synthesizer wrote. We cannot, from this dataset alone, score how often a human later said “ignore that” or “this was gold.” Any vendor or operator who pretends agent output equals validated findings is skipping the expensive step on purpose.

Shareable jobs are only 67. Public artifacts are a biased subsample. If you only study what people chose to show, you will overfit to polished or unusual runs and underweight ordinary private work.

Theme frequencies are not exploit counts. An 81% SSRF-surface mention rate is not an 81% confirmed SSRF bounty rate. It is a narrative and investigative climate signal. Conflating those will make both defenders and hunters make dumb resourcing calls.

If you only steal actions from this report, steal these.

Hunters and operators. Budget wall-clock around the median (about 30-40 minutes) and keep an explicit overflow rule for giant programs. Open every report expecting hygiene debt so criticals feel like upside, not oxygen. Use the stable report skeleton as a draft, then spend human time where the model hedges. If you work bounty, treat scope sync as part of recon setup. The 1,778-program footprint says that workflow already has gravity. Do not manually rebuild program boundaries out of stubbornness.

Defenders. Resourcing only for exotic bugs while headers, leakage, CORS, and takeover hygiene stay messy means you are fighting last year’s highlight reel. GraphQL in over half the long-report sample means “we do not have that” should be proven with inventory, not vibes. Cloudflare-range edge presence is common enough that your external testing assumptions should include bot friction and cached paths. A clean exotic-bug scoreboard plus dirty baseline posture is still a dirty external program.

Builders of agentic security tools. Measure task completion, cancel shape, and hard-fail rate before you optimize wow screenshots. Version-aware CVE logic is worth the engineering tax if you care about trust. Report tone, hedging, and skeleton stability are product surfaces, not copywriting afterthoughts. The hardest unsolved problem in this corpus is not “can we run more tools.” It is “can we get good runs onto schedules so drift becomes measurable.”

Cross-cutting bottom line. The 45-agent pipeline holds under volume. The AI reports are usable. The high-frequency findings match what strong humans already triage first. Precision CVE handling keeps noise lower than naive multi-tool dumps. The next leap is longitudinal: same targets, recurring schedules, attack-surface drift over time.

If you want the stack: squidscanner.com. If you want humans who live in this distribution every week: SquidSec.

– Mr. The Plague / SquidSec