Pentest your iOS and Android apps

Aikido’s agents install your actual Android or iOS app, log in as a user, and attack it the way an adversary would, working through the app and its backend at the same time. Every confirmed issue also comes with the exact steps to reproduce it.

A manual engagement takes days or weeks to schedule and happens once, tests a version that’s already outdated by the time you get to it, then goes stale as you keep shipping even after getting the report. Mobile AI pentesting runs whenever you want and returns reproducible, exploit-confirmed results.

Usually within hours. Upload your APK or IPA, link your source code, add a test user, and the agents start working through the app. You can follow every step live while it runs.

The mobile source code is required, since mobile pentests are whitebox only for now, on both Android and iOS. The backend codebase is optional, but adding it improves API coverage. With the source and the running app in front of them, the agents reach logic flaws that are hard to find from the outside.

Yes. For Android, the build can’t use certificate pinning, and it can’t have root detection, emulator detection or any runtime application self-protection (RASP) enabled. Those protections stop the agents from installing and instrumenting the app on a test device, so upload a build with them disabled. For iOS, upload a signed IPA that isn’t encrypted.

Everything you’d expect from a mobile penetration test, including client-side authentication issues, injection flaws, broken access control, weak session handling, and unsafe API behavior. The agents also test platform-specific behavior at runtime, like unsafe WebViews, deep links and intent manipulation on Android, and URL scheme hijacking and insecure Keychain or data storage on iOS. It also catches business logic flaws and authorization issues like IDORs, cross-tenant access, and authentication bypasses by reasoning about how the app is meant to behave.

Findings are only reported after the agents successfully exploit and confirm them against the live app. If an attack attempt can't be validated, it's dropped and never shown in your results.

Because Aikido already understands your code, AutoFix generates a targeted change for a confirmed vulnerability and opens a pull request, so your team can review the fix and merge it on their own terms. To confirm the fix, recompile the app and upload the new APK or IPA to retest on the same scope.

You define which targets the agents can attack and which they can only reach. Traffic runs through a proxy that validates every request against that scope, agents start non-destructive by default, and pre-flight checks run before the assessment. If something goes wrong, testing auto-pauses and it can be stopped instantly.

Yes. Every run produces an audit-ready penetration test report with validated findings, proof-of-exploit, and remediation guidance.

Aikido's agents matched human coverage and in some cases exceeded it by exploring more paths consistently, including the deep logic flaws a manual tester usually misses. Frequency is the only thing that changes: a human pentest happens once, while the agents can re-run whenever you upload a new build.

Yes. Upload an APK, an IPA, or both to one assessment. Both apps usually share the same test users and backend, so you set those up once, and the findings for both apps and the API land in one report.

No. Android and iOS run in one assessment, priced by scope. Aikido sizes it to what’s actually in your apps and shows you the credit cost before you launch.

No. The agents find the APIs your app calls by using it, then test them. More documentation still helps coverage, and for the best results, connect the backend codebase too.