Technical articles, research notes and CVE write-ups from the rootzero team: offensive security, detection, method.https://rootzero.eu/en-GBhttps://rootzero.eu/en/research/offensive-agents-scope-guardrails/https://rootzero.eu/en/research/offensive-agents-scope-guardrails/An autonomous testing agent that sends requests to real systems must stay within the authorised scope, including when the model driving it makes a mistake or is manipulated by the target’s content. This note describes an architecture in which guardrails are enforced outside the model, on every request: declarative scope, address resolution and pinning, redirect revalidation, rate limiting, graded action classes, lease-based kill switch, hash-chained audit log and the human role. It lists the known pitfalls and the limits of the approach.Thu, 08 Oct 2026 00:00:00 GMTResearchMethodologyPentestAIcontact@rootzero.eu (rootzero)https://rootzero.eu/en/research/proof-before-alert/https://rootzero.eu/en/research/proof-before-alert/Penetration test reports often mix demonstrated findings with inferences: versions assumed to be vulnerable, recognised signatures, ambiguous responses. This note defines what a demonstrated finding is and proposes a five-step chain (hypothesis, attempt, observed response, independent verification, replayable re-test), illustrated by the detection of a server-side template injection. It lists the main classes of false positives and the limits of the approach.Thu, 10 Sep 2026 00:00:00 GMTResearchMethodologyPentestVulnerabilitiescontact@rootzero.eu (rootzero)