In autumn 2026, seven financial institutions in Korea were breached by a single open-source AI penetration tool, and roughly 65,000 customer records were taken. The attack path was not exotic: injection in a peripheral web app, authentication bypass, and bulk harvesting through sequential access. What changed was speed and autonomy.

Once an attack runs itself, the defense has to run itself too. That is the premise behind Chitos.

What autonomy looks like here

Chitos forms its own audit hypotheses from reconnaissance, and when one path is blocked it researches another and keeps going, widening coverage without a human spelling out each step. Then an AI verification layer re-reads every first-pass finding and filters false positives, so what you get is reproducible evidence, not a pile of maybes.

The numbers

On the OWASP Benchmark, the base scanner scores 52.8 Youden.…