Agent AI scanning
The agents that investigate an application: one main researcher, up to three specialists, independent verifiers, and the Hermes conversation agent.
Hunt Web uses a main researcher and up to three specialist agents to investigate an application. Independent verifier sessions examine submitted vulnerability candidates. Hermes Chat adds a conversation agent that reads saved results and forwards instructions to the scanner attached to a Run.
The full research team therefore consists of four agents: one main researcher plus three specialists. Verification adds sessions when needed, so the total is not a fixed five agents for every scan. The team also develops over time: the researcher begins the assessment before the automatic specialist wave starts.
- 1
- Main researcher
- 3
- Specialists at most per activation
- 4
- Research agents in the full team
- 3
- Profiles sharing the same team limit
| Workflow | Research agents during an active assessment | Additional agent sessions |
|---|---|---|
| Blackbox | One main researcher and zero to three specialists. | Independent verification for accepted candidate submissions. |
| Greybox Environment | One main researcher and zero to three specialists, using the configured account access. | Independent verification with the relevant account and evidence checks. |
| Greybox Browser | One main researcher and zero to three specialists, using the declared account Browsers. | Independent verification with fresh evidence and the relevant account binding. |
| Hermes Chat: read saved results | No scanner agents are started by the read request. | One Hermes conversation agent answers from saved records. |
| Hermes Chat: continue testing | The selected Run's researcher and eligible specialists perform the investigation. | One Hermes conversation agent, plus verification sessions when candidates are submitted. |
What counts as an agent
An agent here means a model session with a specific responsibility and tool access. A Browser window, HTTP request, installed scanner, skill file, or target account does not count as another agent. Several agents can use the same configured model; four research agents do not require four different model providers.
- Hermes conversation agentOne per selected Run
- Main researcherStarts and coordinates the assessment
- Authorization and business logicauthz-logic
- Server-side injectioninjection-serverside
- Client-side and API behaviorclient-source
- Independent verifierAdded when a candidate is submitted
Initial reconnaissance. The main researcher begins the assessment before the automatic specialist wave starts.
Quick, Standard, and Deep Use the Same Team Limit
| Profile | Main researcher | Maximum specialists per activation | Investigation emphasis |
|---|---|---|---|
| Quick | 1 | 3 | Prioritize useful surface and strong signals within a shorter assessment budget. |
| Standard | 1 | 3 | Cover a broader set of endpoints, parameters, and workflows. |
| Deep | 1 | 3 | Allow more extensive alternatives, stateful workflows, and follow-up investigation. |
Deep does not add specialists
Profiles change investigation budgets and coverage policy. Selecting Deep does not raise the specialist limit above three. A scan that stops early, lacks sufficient surface, or uses a focused continuation can involve fewer specialists than the full automatic wave.
Counting Across Resume and the Full Run History
An activation is one period of scanner execution, such as the initial Start or a later Resume. The three-specialist limit applies to that activation's delegation capacity. A resumed activation can create new specialist sessions while retaining the earlier specialists' records and evidence.
- 1StartThe first activation: the initial scan work.
- 2Specialists workUp to three in this activation. Records and evidence are kept.
- 3ResumeA later activation. It can create new specialist sessions.
- 4Run historyUnique identifiers across all activations can exceed one moment's team size.
Historical identifiers are not simultaneous agents
The number of unique agent identifiers in a Run's complete history can therefore exceed the size of its team at one moment. Verifier retries and separate candidate checks also contribute additional session identifiers. Counting historical identifiers as simultaneously active agents would give an incorrect picture of resource use.
For a particular assessment, use its saved specialist lifecycle records and verification outcomes to determine what actually ran. In the Dashboard, review the Run's Investigation, Results, and Hermes execution status to follow the work and its outcome. Message delivery, recorded traffic, and a verified Finding represent different stages; a larger team alone does not establish complete coverage or guarantee a finding.
In this section:
- Blackbox agents: the main researcher, the specialist team, coordination, and independent verification.
- Greybox agents: Greybox Environment, Greybox Browser, and how account count differs from agent count.
- Hermes Chat agents: reading saved results and continuing a Run.
Continue with Scanning Features and Workflow for assessment setup, Hermes Chat and Templates for follow-up instructions, and Scanning Tools and Skill Library for the capabilities used by the research agents.