Trae Code Automated Penetration Testing in Practice: A Full Walkthrough of AI Agent Vulnerability Hunting

Introduction: AI Agents Are Reshaping Security Testing

As large language model capabilities advance rapidly, AI has moved beyond coding assistance and begun making inroads into cybersecurity. Recently, a Bilibili content creator shared an automated penetration testing workflow built on ByteDance's Trae Code. By configuring custom Skills, they enabled an AI Agent to autonomously complete an end-to-end pipeline — from information gathering and vulnerability probing to data extraction — targeting classic vulnerabilities like SQL injection and RCE (Remote Code Execution).

This kind of work showcases the enormous potential of AI in offensive and defensive security, while also serving as a reminder of AI's double-edged nature. This article provides an objective breakdown of the technical workflow and the security logic behind it, helping readers understand the capability boundaries of AI Agents in penetration testing scenarios.

Important disclaimer: All techniques described in this article are intended solely for security research and CTF/lab environments with explicit authorization. Conducting penetration tests on systems without authorization is illegal.

What Is Trae Code: Tool Overview and Setup

Trae is an AI-powered programming IDE developed by ByteDance. Its domestic version, trae.cn, offers the Trae Code product. According to the content creator, new users receive approximately 4,000 credits upon registration. A medium-scale asset test consumes around 100 credits, while smaller targets may cost only a few dozen — making its token consumption costs highly competitive compared to similar AI security testing tools.

Core Configuration: The Penetration Testing Skills Pack

The key to the entire automated workflow is importing a custom penetration testing Skills pack (referred to in the video as Squaze / VIP Skills). The setup steps are roughly as follows:

Download and install Trae Code from trae.cn
Register, log in, and open the IDE
Navigate to Settings → Skills & Commands
Select "Create Global," then upload the Skills pack file
Fill in the skill description, click confirm, and wait about ten seconds for it to load

Do not unzip it here

One notable detail: the creator specifically warns not to unzip the Skills pack — upload the compressed file directly. At its core, this Skills pack is a set of preconfigured Prompt Engineering templates and workflow instructions that guide the AI to execute tasks step-by-step following penetration testing methodology.

Test 1: AI-Automated Manual SQL Injection

With everything configured, the creator used a public practice target (CTF lab) for the demo. The instruction was deliberately concise and specific:

"Use this skill to perform a manual SQL injection attempt on XX. Do not use scripts or tools. Return the database name and table names at the end."

There's a technically significant detail here — the explicit requirement to avoid automated scripts and tools like sqlmap, forcing the AI to simulate a "manual injection" approach. This means the AI must genuinely understand injection principles, progressively construct payloads, determine the injection type, and infer the database structure.

Continue retrieving columns and account data from the User table

Based on the demo results, the AI entered reasoning mode, tested the target parameter for injection type, and ultimately output the database name, table names, and database version number, while also identifying the injection type (GET-based). Going further, the AI proactively suggested "Would you like to continue and retrieve columns and account data from the User table?" — demonstrating the Agent's capacity for sequential task planning. This step consumed approximately 57 credits.

SQL Injection is one of the oldest yet still highly prevalent web security vulnerabilities. The core mechanism involves an attacker inserting malicious SQL fragments into user input fields; when the backend directly concatenates user input into a database query, those malicious fragments get executed by the database engine, potentially resulting in data leakage, authentication bypass, or even unauthorized writes to the database. Traditional manual injection requires testers to sequentially identify the injection point type (e.g., GET/POST parameters, cookies), the database type (MySQL/MSSQL/Oracle, etc.), and the injection method (UNION-based, error-based, Boolean blind, time-based blind), then incrementally construct payloads to enumerate database names, table names, and column names until sensitive data is extracted. This process demands strong SQL syntax knowledge and logical reasoning. By deeply understanding injection principles, an AI Agent can simulate this reasoning process and autonomously decide on the next payload — which is precisely what makes the "no sqlmap" constraint in this demo a genuine test of capability.

Test 2: RCE Vulnerability Discovery and Privilege Escalation

The second demo target was a lab site with an RCE (Remote Code Execution) vulnerability. Compared to SQL injection, RCE hunting better demonstrates the AI's holistic analytical capabilities.

A Complete Chain from Recon to Exploitation

According to the demo, the AI began with information gathering by analyzing forms and parameters, then moved on to exploitation attempts. During the test, the AI successfully retrieved:

System version and container information
PHP version number
Three database records (including MD5-hashed passwords)

Interestingly, for the MD5-hashed password 123456, the creator immediately used an MD5 lookup tool to verify it on the spot, confirming that the data extracted by the AI was genuine.

Then both manual and AI methods are at your disposal

RCE (Remote Code Execution) is one of the highest-severity vulnerability categories. Once successfully exploited, an attacker can execute arbitrary system commands on the target server, typically leading to full server compromise. RCE vulnerabilities stem from a variety of causes, including: insecure deserialization, file upload extension bypasses, command injection (e.g., PHP's system() or exec() functions concatenating user input), and server-side template injection (SSTI). In real-world penetration testing, typical post-RCE actions include: reading sensitive files like /etc/passwd and /proc/self/environ, retrieving database configuration files, writing a webshell for persistent access, and lateral movement to other hosts on the internal network. The AI autonomously completing information gathering and providing privilege escalation suggestions in the demo is essentially a simulated execution of this standard attack chain.

AI-Guided Privilege Expansion

After obtaining RCE, the AI didn't stop there. It continued offering follow-up suggestions: retrieving the current user, system information, and web directory path, and attempting to read sensitive files and test for backend privilege escalation.

Continue outputting information for us

At this point, the creator offered a key professional insight:

"You can hand it off to the AI and let it expand access — but only if you already have a plan. If you have no idea what you're doing and you're purely following AI prompts to escalate, the AI is still just a tool. The strategic thinking has to come from you."

This cuts to the heart of AI-assisted penetration testing today: AI excels at execution and exploration, but the strategic judgment behind an overall attack chain still depends on human expertise.

Strengths and Real-World Limitations of AI Penetration Testing

Four Key Strengths

From this hands-on test, several notable advantages of AI Agents in security testing emerge:

Speed: The creator noted that Trae Code executes noticeably faster than comparable tools
Low cost: A single test consumes only tens to a few hundred credits
End-to-end pipeline: From information gathering and vulnerability probing to data extraction and privilege escalation, the AI can progress autonomously
Multi-model collaboration: Can work in parallel with multiple models like Trae1 and Claude to improve vulnerability coverage

Three Real-World Limitations

We should also be clear-eyed about the current shortcomings of AI penetration testing:

Dependence on human strategy: AI cannot replace the overall strategic planning of a penetration testing engineer — human direction of the attack path remains essential
The gap between labs and production: All demos were conducted on public practice labs; real environments are far more complex, with defensive mechanisms (WAF, honeypots, IDS) that vastly exceed lab conditions
Hallucination and false positive risks: The inherent hallucination problem in large language models can lead to misidentified vulnerabilities — all test results must be manually verified

WAF (Web Application Firewall), honeypots, and IDS (Intrusion Detection Systems) are the three most common active and passive defense mechanisms in real production environments. WAFs use rule-based filtering to block malicious requests, capable of detecting and intercepting a wide range of known SQL injection and RCE payloads. Honeypots lure attackers with fake high-value assets and log their behavior, effectively exposing attack intent. IDS continuously analyzes network traffic and triggers alerts or automatic blocks on anomalous behavior. Practice lab environments typically don't deploy these defenses, which means the high success rates AI Agents achieve in labs may not translate to real production systems — facing WAF rule interception, the AI needs bypass capabilities; against honeypots and IDS, the AI's probing behavior itself leaves traceable footprints. This is a challenge that all current automated penetration testing tools commonly face.

Conclusion: The Technology Is Neutral — Compliance Is Non-Negotiable

The practice of combining Trae Code with penetration testing Skills offers a vivid demonstration of AI Agents' potential in cybersecurity — significantly lowering the operational barrier and time cost of penetration testing, making it an efficiency tool worth attention for security researchers.

However, precisely because the barrier has been lowered, compliant use of this technology becomes all the more critical. The prerequisite for penetration testing is always authorization — any "vulnerability hunting" conducted outside an authorized scope crosses a legal line. For security professionals, AI is a lever that amplifies capability. For the industry as a whole, the more pressing question is how to build stronger defensive systems in an AI-enhanced world — and that is a challenge everyone must confront.