Continuous Bug Hunting Automation: Vexta's AI Loop and Hunt Mode

Continuous bug hunting automation means a scanner that keeps testing an authorized target over time and gets more targeted about what to try next, instead of running once and going quiet. Vexta is VITI Security's agentless, AI-augmented vulnerability scanner and pentest platform, and it pairs an AI-driven discovery loop that reasons about each endpoint with a continuous-hunt mode that wakes on a schedule and keeps testing, so an authorized target's coverage builds up over days and weeks instead of resetting every time a scan is kicked off by hand.

How does Vexta's AI discovery loop decide what to try next?

For each endpoint, an endpoint analyser feeds an LLM the URL, the observed request and response shape, the parameter names and the auth scheme, and asks for a ranked list of probe ideas with a rationale attached to each one. That rationale is the part worth noticing: the loop is not just spraying payloads, it is producing a reason a hunter can read and judge before the probe even runs.

Vexta supports Anthropic Claude, OpenAI, Google Gemini and Azure OpenAI through a provider abstraction, and the operator supplies their own API key under Settings, AI providers. Spend is capped per scan, $5 by default and tunable up to $50, so a long scan against a large target cannot run up an unexpected bill.

How does Vexta decide a probe actually found something?

Generating a probe idea is only half the loop. Once a probe runs, its result and the original rationale go back to the LLM with a direct question: does this response indicate a real bug? Only when the model's confidence is 0.6 or higher does that answer turn into a Finding a hunter sees in the results.

Every one of those calls, prompt, completion and cost, gets written to an audit trail. That matters beyond bookkeeping: if a finding ever gets questioned on a program or in a client engagement, there is a record of exactly what was asked, what came back and why the loop decided a probe was worth flagging, which is the kind of documentation a legal or compliance review will eventually want to see.

What if I don't want to use AI, or don't have a key configured?

AI triage in Vexta is bring-your-own-key and entirely optional. With no key configured, the discovery loop falls back to a fixed seed-payload list instead of LLM-generated probe ideas, and scanning, verification and ranking all keep working exactly as before. Turning AI on adds reasoning about what to try and why; turning it off does not turn Vexta into a lesser scanner, it just removes the LLM layer from the discovery step.

What does continuous-hunt mode add on top of the discovery loop?

A continuous hunt is a long-running job that keeps its state across server restarts, wakes at a configured interval, 24 hours by default, and runs one fresh scan against the target on each wake. It carries a daily probe budget and a per-target rate limit, and it stops automatically on a WAF block rather than pushing through one.

Hunts are managed from the /zero-days UI or through the continuous-hunts API, where they can be paused, resumed or deleted, and their state persists locally so a restart does not lose progress. For a program that pays out on novel findings over time, that persistence is the point: a target that looked fully covered last month can look different after a deploy, and a continuous hunt is there to notice.

State is persisted locally under the hunt's own configuration directory, so a server restart mid-hunt does not silently drop it back to a fresh setup. Each wake still runs one complete scan against the target, but the hunt's schedule, budget and progress survive the kind of routine restart that would otherwise force a hunter to reconfigure and relaunch it by hand.

Staying inside scope on a hunt that runs for weeks

This mode lives inside Vexta's Zero-Day Engine, which activates on the zero_day_hunt profile behind a double consent gate, confirming both that the target is authorized and that it is staging or otherwise permitted for this kind of testing. That gate exists because a hunt that keeps running unattended for weeks needs firmer confirmation up front than a one-off scan does.

The daily probe budget and per-target rate limit are what keep a long hunt from drifting into something that looks like a denial-of-service attempt, and the automatic stop on a WAF block means the hunt backs off the moment a target's defenses react, rather than treating that reaction as something to push past.

Key takeaways

The essentials on Vexta's AI discovery loop and continuous-hunt mode: