Yes, even Penetration tester can miss hidden vulnerabilities. No matter how deeply you test a system, some security flaws can still slip through unnoticed. That’s exactly what happened at TryHackMe, a popular cybersecurity learning platform.
In a recent LinkedIn post, Ben Spring, co-founder of TryHackMe, shared an interesting story about how an AI-powered security tool discovered a serious vulnerability on their platform—something that human security experts and manual testing methods had failed to catch.
“It’s a good reminder that even strong security teams can miss things. Sometimes, having another set of “eyes”—in this case, an AI system—can uncover problems that people simply don’t spot. We’ve had white-box security assessments, multiple traditional pentests & a very active (paid) bug bounty program. Everything missed this vuln, including the white-box work with full code access. Black-box testing catches the whole live application, setup, services, configs, database and all, not just code in isolation. White-box assessments are still important and you should use both (we do) – I’m just highlighting the value black-box AI pentesting adds.”
What Happened?
TryHackMe takes security seriously. They use multiple defensive layers, including:
- White-box code reviews: Security experts looking directly at their source code.
- Manual penetration testing: Human ethical hackers trying to break in.
- Paid Bug Bounty programs: Paying independent security researchers worldwide to find flaws.
Despite all the testing, an AI-powered security tool called NoScope managed to uncover a serious vulnerability that everyone else had missed. TryHackMe quickly patched the issue once it was identified.
Why Did the AI Catch It When Humans Didn’t?
Ben explained that the secret comes down to how the testing is done:
- White-Box (Looking at the Code): This is basically like going through a building’s blueprint before entering it. You can spot coding mistakes and obvious logic problems, but you may not see what happens when all the different parts of the application are running together.
- Black-Box (Testing the Live App): This is more like testing the actual building instead of just studying the blueprint. The AI interacts with the live application and can find problems caused by the way the database, server, configurations, and other connected services work together.
Because AI agents can cover massive amounts of ground very quickly, NoScope tested the entire live setup in ways static code reviews couldn’t replicate.
This Isn’t a One-Off Success
To show that this wasn’t just a fluke, Ben pointed to another major discovery by NoScope: `CVE-2026-27771`.
The AI agent discovered a missing authorization bug in Gitea (a popular code-hosting tool). The flaw silently exposed private container images across more than 30,000 live servers, leaking sensitive data in healthcare, aerospace, and retail industries before it was caught and fixed.
Key Takeaways for Developers and Security Teams
Ben shared two main lessons for engineering teams:
1. Automate Security as You Code: Developers are using AI tools to write software faster than ever. Security testing needs to keep pace by running automatically—triggered whenever new code is pushed or when new vulnerabilities pop up.
2. Use Both Testing Approaches: Don’t pick between reviewing code (white-box) or testing live apps (black-box). You need both to catch hidden flaws before hackers do.
TryHackMe has now plugged the vulnerability and integrated regular, automated AI tests into their deployment setup to catch issues before code hits production.
