2 Building your first AI agent
This chapter introduces the shift from simple script-based automation to structured AI agents for offensive security workflows. Scripts are useful for repeatable tasks, but they are brittle in dynamic environments because they follow predefined instructions and rely on humans for judgment. LLMs add reasoning, but on their own they lack persistent memory, controlled action, accountability, and reliable state management. The chapter frames an agent as a controlled decision-making system that receives input, reasons about next steps, acts through tools, observes results, and records what happened so the workflow can be inspected, replayed, and defended.
The chapter explains the core architecture of an agent through components such as messages, tools, memory, controllers, and artifacts. Messages structure communication, tools let the agent interact with external capabilities, memory preserves context, controllers decide the next action, and artifacts provide durable records for auditing and replay. It also presents the ReAct-style loop of reasoning, action, observation, reflection, and recording as the foundation for agent behavior. A minimal framework-agnostic agent specification is then implemented in Python using simple tools that extract and summarize URLs, with explicit logging to show how decisions, inputs, outputs, and observations move through the system without hidden framework behavior.
The chapter emphasizes that autonomy in offensive security must be governed by strong safety controls. It describes safety gates, sandboxing, comprehensive logging, operational policies, and kill switches as essential mechanisms for keeping agents within authorized and ethical boundaries. The final application is a triage agent that works only on previously collected reconnaissance data, such as saved scan output, and produces a prioritized summary of hosts or services that deserve human attention. Rather than exploiting systems or replacing expert judgment, the agent reduces noise, highlights anomalies, records its reasoning, and helps testers move more consistently from raw recon data to defensible next steps.
The difference between a script and an AI agent. Scripts are an example of procedural programming, in which instructions are followed step by step. In contrast, an AI agent can reason by itself and act without human intervention.
An agent schematic. An AI agent consists of a controller that orchestrates the execution of data inputs, function calls, and model outputs. Model outputs and other logging information is saved into artifacts, which are persistent files. A model can interact with the world using tools, which are functions that AI model can implement. A model can use multiple tools, expanding their utility.
A ReAct agent consists of 5 steps that are iterated until they converge to a desired outcome: 1) Reason → Use the LLM to plan a step. 2) Act → Execute that step with a tool. 3) Observe → Capture the result. 4) Reflect → Update memory and decide again. 5) Record → Write everything to an artifact.
Sandbox isolation model. Agents should be tested in a restricted process inside a network-limited container for defense. That way, if a safety gate falls (e.g., a human verifier doesn’t catch an error in reasoning logic), the system remains intact.
The triage flow. This diagram shows how information moves through the loop and how every transition is logged for replay.
Triage agent summary. The agent transforms raw recon output into a short, prioritized summary that highlights hosts and services that require human attention.
Summary
- Agents wrap reasoning around action. Where an LLM predicts the next token, an agent predicts the next step—using tools, memory, and feedback to pursue a goal.
- The Minimal Agent Spec makes autonomy reproducible. A consistent schema for messages, tools, observations, and artifacts allows your agents to run anywhere and be inspected later.
- Safety is engineered, not assumed. Gates, sandboxing, logging, and kill switches keep AI experimentation ethical and auditable.
- The Triage Agent demonstrates the full loop. It reasons about data, takes controlled action, records evidence, and reports findings—all within a defined scope.
FAQ
What is the main goal of building the first AI agent in this chapter?
The goal is to show how wrapping an LLM with explicit components—messages, tools, memory, controllers, and artifacts—turns simple text generation into a controlled decision-making loop. The chapter focuses on clarity, auditability, and defensibility rather than building a production-ready or overly complex system.
How is an AI agent different from a traditional script?
A script follows a predefined sequence of instructions and often breaks when the environment changes. An AI agent, by contrast, can receive input, decide what to do next, call tools, observe results, and record what happened. Agents are better suited to dynamic workflows because they add reasoning, control, and traceability.
Why is an LLM alone not enough for offensive security workflows?
An LLM can summarize information, suggest next steps, or identify anomalies, but by itself it only responds to prompts. It does not persist state between actions, interact with tools, observe changing environments, or reliably explain and record decisions. In security contexts, that lack of structure and accountability can become a liability.
What are the five core components of an AI agent?
The five core components are:
- Messages: Structured communication between the system, user, model, and tools.
- Tools: External capabilities such as functions, APIs, scanners, or databases.
- Memory: Stored context from previous messages, results, or summaries.
- Agent controller: The logic that determines the next action.
- Artifacts: Durable records such as logs, reports, or database entries that show what happened.
What is the ReAct agent loop?
The ReAct loop stands for Reasoning, Action, and Observation. The agent reasons about what to do, takes an action using a tool, observes the result, and repeats until the task is complete. The chapter also adds Reflection and Recording to improve real-world performance, transparency, and auditability.
Why are artifacts important in agent design?
Artifacts provide a durable record of what the agent did, including inputs, outputs, tool calls, observations, approvals, and results. They make agent behavior auditable, replayable, and defensible. In security work, artifacts help prove that the agent stayed within scope and support debugging, compliance, and defensive analysis.
What is the minimal agent specification?
The minimal agent specification is the smallest set of interfaces and data structures an agent needs to be portable, testable, and safe. It defines behavior in terms of explicit messages, tool invocations, observations, and recorded artifacts. The goal is portability and auditability, not feature completeness.
What does the minimal agent built in the chapter do?
The minimal agent performs a simple deterministic workflow. It extracts URLs from local input text using one tool, records the result as an artifact, passes that artifact to a second tool that summarizes the URLs, records the second result, and then stops. It has no memory, no optimization, and no network access.
What safety and governance controls should AI agents include?
AI agents used in offensive security should include controls such as safety gates, sandboxing, comprehensive logging, operational policies, and kill switches. These controls help ensure that agents operate only within authorized scope, limit potential damage, preserve human oversight, and create an audit trail for accountability.
What is the purpose of the triage agent described in the chapter?
The triage agent reviews already-collected reconnaissance data and produces a prioritized summary of hosts or services that deserve human attention. It does not scan, exploit, or probe networks. Its job is to reduce noise, flag unusual exposure, group similar hosts, surface red flags, and preserve reasoning so testers can decide where to focus next.
AI Agents for Offensive Security ebook for free
