Targets and missions

Overview

The Targets page shows every asset your engagements cover (a domain, subdomain, IP, cloud account, repository, container image or LLM endpoint) and what the AI agent is doing on each one. Open it from Pentests > Targets.

Each target has a list of missions. A mission is one thing the agent set out to prove, such as "IDOR on order lookup", or, on an LLM target, one red-team attack. You can read each step the agent took, open the exact test script it ran and the raw output, and see the verdict. When a mission confirms an attack, PENOPS creates findings on your delivery boards.

Use this page to see what the agent is testing right now, to answer the agent when it pauses for your approval (see Human-in-the-loop approvals), and to check the evidence behind a finding.

The targets list

Targets are grouped by engagement. Each engagement shows a type badge: Web App, Cloud, LLM or Secrets. Search with Search target name, IP, model..., pick an engagement from the engagement menu, or filter by Hostname, IP, Org, Engagement, Engagement type, Status, Risk and Open findings.

The robot icon on each row shows the target's status:

The tiles at the top of the page summarise the targets that match your current filters:

A dash in a tile means the number has not been counted yet, not zero.

To add a target, click Add target. This opens the engagement's settings, because scope is changed there (adding scope can change the engagement's cost). See Engagement settings.

Missions and Past missions

Select a target to see its missions in two tabs. Each tab shows a count.

• Missions lists the missions worked by the target's latest scan, plus any mission waiting on your approval and any you answered (or that a follow-up resent) since that scan began. They are grouped into Needs approval, Running and Completed; empty groups are hidden.
• Past missions lists every other mission on the target, from earlier scans.

Missions are sorted with the most recently active first. Activity means a finding changed, the agent started a new message, or an approval was asked or answered. Each row shows its status (Needs approval, Running, Confirmed, Not vulnerable, In progress or Inconclusive), when it was last active, and how many steps it has.

Nothing opens by default. Click a mission row to open its thread.

Read what the agent did

1. Open Pentests > Targets and select a target.
2. Click a mission in the Missions or Past missions tab.
3. Read the thread stage by stage. Agent messages are headed AGENT with a time; on an LLM target, the target's replies appear on the right headed TARGET.
4. Click Show the test and its output, then a Run N entry, to see the script the agent ran and the raw output.
5. On a confirmed mission, click an ID-<number> link to open the finding card on the board it sits on now.

Each message carries a heading that names its stage:

A message can also show In progress, Stopped: the scan ended first or Failed. Completed messages show no note. A thread with nothing in it yet reads No messages yet. The agent will start when scanning begins.

The badge Latest next to a mission's title means the mission has been active since the target's latest scan began.

Attempts, test scripts and output

When the agent rebuilds its test, the thread shows an Attempt N divider. Attempt numbers carry across scans, so attempt 3 may come from a later scan than attempt 2.

Each run of a test has a result:

An opened run shows the protocol and endpoint, a Script section (the Test itself, in Python, Bash or sh, plus any Setup script and Verification script) and an Output section (Matched, Not matched, Extracted, Error, Setup script result, Verification script result). A test that never ran shows Rejected in review: <reason> or Not run: <reason> and no output.

When a mission confirms an attack, its closing message reads Attack confirmed. I created the following findings on the boards: followed by links to each finding, coloured by severity.

Good to know

• A mission is listed while it is running, waiting on your approval, or confirmed. Missions the agent ruled out or that failed are not listed. A new hypothesis appears late in planning, so the agent may be working before a mission shows.
• Only a confirmed mission creates findings. Finding links always open the card on its current board, even after it moves.
• The list and the open target refresh every few seconds while something is running. The open mission refreshes while it runs.
• Agent messages, scripts and target output are shown as plain text. PENOPS treats them as untrusted and never renders them as links or markup.
• Some very large scripts or outputs are cut at 64 KiB. The run then shows Some of this was cut at 64 KiB; what is shown is not the whole record.
• The page does not label a mission's kind. You can tell LLM red-team attacks from other tests by the engagement's LLM badge.
• To see an earlier scan of the same mission, use the History tab of the Agent Profile.

Permissions