> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/artificial-intelligence/ai-agents/agentic-ai.md). # Agentic AI Agentic AI is not just about generating answers. It is about building a system that can think, take actions, observe results, and continue working step by step until a task is completed. Instead of a single response, it operates in a loop where each step depends on the previous one. In a pentesting scenario, when you provide an input like `test example.com`, the system does not simply return text. It performs actions. It may begin with an nmap scan, analyze open ports, decide to move into web testing, run fuzzing tools, and continue based on results. This behavior comes from combining reasoning, execution, and memory. At the core, an agentic system consists of a reasoning component (LLM), execution tools, and memory to track progress. *** ## How an Agent Works An agent follows a continuous cycle: * It receives an input * It decides what to do next * It executes a tool * It observes the result * It updates its internal state * It decides the next action This loop continues until the task is complete. For example, if the system finds that port 80 is open, it does not need to scan again. It uses that information to move forward into web enumeration. *** ## Understanding RAG (Retrieval-Augmented Generation) A large language model does not automatically know your personal notes, payloads, or methodology. It only knows what it was trained on. If you want your system to behave based on your own research, you need a way to provide that knowledge dynamically. This is where RAG is used. RAG is a method that allows the system to retrieve relevant information from your own data and use it while generating a response. Instead of storing all knowledge inside prompts or retraining a model, you store your data externally and retrieve only the relevant parts when needed. *** ## How RAG Works in Practice The process begins with your data. This could be pentesting notes, payloads, techniques, or playbooks. First, the data is broken into smaller pieces called chunks. Each chunk should represent a meaningful unit of information. For example, a list of SQL injection payloads should stay together instead of being split randomly. Next, each chunk is converted into an embedding. An embedding is a numerical representation of the meaning of the text. It allows the system to compare pieces of text based on meaning rather than exact words. These embeddings are then stored in a vector database. A vector database is designed for similarity search. Unlike traditional databases that rely on exact matching, it can find information that is conceptually similar. When a query is made, the system converts the query into an embedding and searches the vector database to find the most relevant chunks. These chunks are then passed to the language model as context. The model generates a response based on this retrieved information. *** ## Why RAG is Important RAG allows your system to use your own knowledge instead of relying on generic responses. It ensures that answers are consistent with your methodology and can be updated easily by modifying your data instead of retraining a model. Without RAG, the system behaves like a general-purpose assistant. With RAG, it becomes a specialized assistant tailored to your work. *** ## Understanding Vector Databases and Storage A vector database is a storage system designed to hold embeddings and perform similarity search. Each stored item contains: * The original text (chunk) * Its embedding (vector representation) * Optional metadata such as topic or category When a query is made, the database compares the query embedding with stored embeddings and returns the closest matches. This allows the system to retrieve relevant information even if the wording is different. For example, a query about bypassing login can match stored content about SQL injection authentication payloads, even if the exact words do not match. Common tools for this include FAISS for local setups and other scalable solutions for larger systems. *** ## Short-Term Memory Short-term memory is used during the current execution of the agent. It stores information that is needed while the task is running. This includes: * The target being tested * Results from tools such as open ports * Steps that have already been completed It is usually implemented as a structured object such as a dictionary. For example, after running an nmap scan, the result is stored in short-term memory. The agent then uses this information to decide the next step instead of repeating the scan. Short-term memory is temporary and is cleared when the session ends. *** ## Long-Term Memory Long-term memory stores information across multiple sessions. It allows the system to remember what has already been done in the past. This includes: * Previous scan results * Identified vulnerabilities * Completed tasks * Historical data for reporting It is typically stored in a database or files. For example, if a target has already been scanned earlier, the system can reuse the results instead of starting from scratch. This improves efficiency and enables continuity. Long-term memory is especially important for real-world workflows where tasks are not completed in a single run. *** ## How Everything Works Together When all components are combined, the system becomes much more powerful. A typical flow looks like this: The user provides a target. The system first checks long-term memory to see if any data already exists. If not, it proceeds with scanning. The results are stored in both short-term and long-term memory. The agent then needs to decide what to do next. At this point, it uses RAG to retrieve relevant knowledge from stored notes. Based on this knowledge, it selects the next action and executes the appropriate tool. This process continues in a loop. Each step updates memory, retrieves knowledge when needed, and drives the next decision. #### In Short * RAG is responsible for knowledge. It answers the question of what the system knows. * Short-term memory is responsible for the current state. It tracks what is happening right now. * Long-term memory is responsible for history. It tracks what has already happened in the past. Together, they allow the system to behave intelligently, avoid repetition, and make decisions based on both knowledge and experience.