AI Explorer · Tier 3 open hunt
Opus-grade open exploration on the full recon bundle (clustered endpoints + JS-derived URLs + discovered params). Hunts for what the scripted scenarios missed.
What it is
Tier 3 is the final stage of the Deep Audit AI Explorer. It runs after Tier 1 + Tier 2 have generated, probed, and resolved their candidate list. Tier 3’s job is open-ended hunting: “forget the candidate list, given the full recon picture, what did we miss?”
It runs on Claude Opus (the heaviest reasoning tier) and has a longer turn budget than Tier 2. The context window includes:
- Clustered endpoint inventory (up to 200 representative clusters)
- JS-derived endpoint pointers (paths extracted from JavaScript bundles the scanner extracted)
- Discovered parameter names (from the scanner’s hidden-param fuzz)
- A SKIP list of endpoints Tier 1+2 already confirmed
- A “don’t retry without new evidence” list of Tier 2 rejections
What it produces
Open-form findings: anything Tier 3 can prove against the live target. Same evidence requirements as Tier 2: real probe sequence, real response bytes, confidence score.
Typical Tier 3 yield: 1-4 findings per scan, in the harder-to-find classes (chained auth bypasses, business logic, novel parameter abuse, encoded injection that the static modules’ payload pool didn’t try).
Why it matters
Scripted scenarios miss anything they don’t have a playbook for. Tier 3 is the catch-all that turns “scanner + 10 scenarios” into “agent that read the whole app and hunted.” It’s also where the it regularly surfaces findings a scripted scanner would never reach.
Cost model
Every stage is covered by the single Audit the scan spends — nothing is counted on top. All stages share one internal per-scan AI budget, and the open hunt runs only if budget remains.
Tunable
Disabled per-deploy via the deep-audit configuration=false (for
example, while bringing up a new environment or during a cost-
tuning experiment). On by default in production.