RLcapstone.ai

Watch the agent test the practice application

This replays the exact attack path the Q-learning agent learned. Beginning from twelve possible actions, it has determined which four actually matter — reconnaissance, followed by one effective payload for each of the three vulnerabilities.

Safe replay — nothing runs live here. This animates a recorded sequence from training against a purpose-built vulnerable application on localhost. It is an educational demonstration of the OWASP Top 10; these techniques must only be used on systems you own or are explicitly authorized to test.

The agent's action set

These are the twelve actions available to the agent. Observe which ones activate as it runs — it learned to disregard the unproductive options (incorrect passwords, ordinary searches, missing pages).

What just happened?

The agent was not told how to attack the application. Across hundreds of training episodes it learned, through trial and error, that reconnaissance followed by three specific payloads is the efficient route to all three vulnerabilities — and that the remaining eight actions waste steps. A random agent, by contrast, requires roughly six times as many actions and frequently exhausts its budget before finding everything. The write-up explains the reinforcement learning behind it.