Autonomous Audits

An autonomous audit runs the deep pipeline, but lets you brief Golem the way you’d brief a human operator: you write the mission in plain English, and the agent plans around it.

Property	Value
Task wall-clock	4 hours
Pipeline	Same as deep, with your scope injected into the agent prompt
Availability	Plan-gated — see Plans
Best for	Targeted engagements, threat-actor emulation, assumed-breach scenarios

How it works

Instead of only picking security focus areas, you provide a scope — a freeform instruction (up to ~1,500 characters) injected into Golem’s system prompt. The agent treats it as authoritative direction and plans accordingly. The scope can be as specific or open-ended as you want:

“Focus exclusively on the OAuth flow at auth.acme.com. Probe for token leakage, scope confusion, and replay vulnerabilities.”
“Find any way to access customer PII. Document the full kill chain end to end.”
“Test only the three subdomains passed as targets. Do not enumerate or interact with anything else under this domain.”

What the scope can include

Element	Example
Target focus	”Only the GraphQL API at /api/graphql”
Tactical constraints	”No brute force. Passive recon only for the first hour.”
Success criteria	”Goal: demonstrate extraction of a user record via IDOR”
Out of scope	”Do not touch the marketing site at www.*”

Combine scope with security focus areas for layered steering.

Running an autonomous audit

API

curl -X POST https://api.usegolem.ai/api/apps/{appId}/audits \
  -H "Authorization: Bearer $GOLEM_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "autonomous",
    "scope": "Focus exclusively on the OAuth flow at auth.acme.example.com. Probe for token leakage, scope confusion, redirect_uri bypass, and replay vulnerabilities. Goal: capture an access token belonging to another user."
  }'

Writing effective scope

Golem responds best to briefs that mirror real operator language: Good scope

Target only app.acme.example.com. Map the authenticated surface
using a low-privilege account, then hunt for broken object-level
authorization between users. Out of scope: any other subdomain,
and no destructive payloads.

Less effective scope

Please test the application thoroughly.

The more concrete the goal, the more focused the engagement.

Authorization caution

Autonomous mode gives Golem maximum latitude. The scope text is injected into the agent’s system prompt and acts as authoritative direction. Be precise about what’s in scope — and be certain you have written authorization for everything in the brief.

Getting Started

Audits

How It Works

Platform

Billing

API

Autonomous Audits

Autonomous Audits

How it works

What the scope can include

Running an autonomous audit

Writing effective scope

Authorization caution

Next steps

The Golem Agent

Toolkit

​Autonomous Audits

​How it works

​What the scope can include

​Running an autonomous audit

​Writing effective scope

​Authorization caution

​Next steps

The Golem Agent

Toolkit

Autonomous Audits

How it works

What the scope can include

Running an autonomous audit

Writing effective scope

Authorization caution

Next steps