As Artificial Intelligence (AI) increasingly powers autonomous offensive security tools (i.e., AI Pentesters); ensuring their operational integrity, regulatory compliance (e.g., under the EU AI Act), and ethical conduct becomes critical, particularly when direct human oversight is limited or absent. To address these challenges, we propose an Intelligent Assurance System (IAS) that provides continuous oversight and accountability for fully autonomous AI Pentesters. The IAS is designed to enhance trustworthiness by monitoring execution traces, enforcing compliance, delivering real-time feedback, and facilitating self-improvement while being resource-efficient.

Penetration testing is an intricate activity, yet vital for the security of web applications and the protection of user data. Due to its time-consuming nature, recent developments have emphasized the use of artificial intelligence to enhance efficiency, shorten testing times, and substantially improve penetration testing results. By combining artificial intelligence with conventional penetration testing techniques, researchers aim to improve the processes, providing organizations with the means to create stronger web applications. This paper presents a thorough review of research conducted between 2013 and 2024 on the application of artificial intelligence in web application penetration testing. We highlight advancements and challenges in employing learning-based methods to enhance penetration testing, providing a comprehensive overview of the current state and future directions in the field. Our results show that leveraging artificial intelligence has proven to be more efficient than traditional approaches, but they still face significant challenges.