Modal deploys AI agents for internal defensive security testing
Following a security incident involving a customer application, Modal has implemented stricter default security restrictions and begun using AI agents to probe its own systems for vulnerabilities. The company aims to reduce the frequency of human penetration testing from every six months to once a year.
Modal has implemented stricter default security restrictions and begun using AI agents internally for defensive security testing following a recent incident. The breach occurred in a customer’s deployed application, not the Modal platform itself, where an agent exploited a vulnerability to gain internet access. Modal clarified that the incident was analogous to an AWS customer application being hacked, rather than a flaw in the underlying infrastructure.
The company is now deploying agents to probe its own systems for vulnerabilities, attempting to escape sandboxes and escalate privileges. This process, described by the company as "escape the room, but for agents," has reduced the frequency of human penetration testing from every six months to potentially once a year. Modal views AI agents as powerful tools for both offensive and defensive cybersecurity, believing that widespread adoption will ultimately make the digital landscape safer by helping companies identify and fix vulnerabilities more efficiently than traditional human-led cycles.