AIHPRA: Evidence-Led Multi-Agent Assessment for Web Application Security

This paper presents AIHPRA (AI-Powered Halluscope Research Agents), a local research prototype designed to support evidence-led web application security assessment. The system follows a staged workflow that separates raw observations, their interpretation, and recommended fixes while maintaining an evidence trail for each reported finding. AIHPRA consists of thirteen cooperating software components, including modules for scope control, reconnaissance, security testing, evidence verification, vulnerability classification, claim checking, remediation guidance, and report generation. Its Halluscope component evaluates the claims associated with findings through six independent checks and flags doubtful results for human review. The prototype was evaluated on Nexa, a fictional online store deliberately created with eight types of planted weaknesses. The evaluation used a controlled, non-destructive testing approach. The initial results show agreement with the planted signals in this specific test environment; however, the study does not establish general real-world scanner accuracy because the evaluation was limited in scope and did not include clean test pages, competing scanners, or a reviewer study. The paper describes the system architecture, testing methodology, findings, limitations, and future research directions. Its main objective is to make web security assessment results easier to inspect, verify, challenge, and remediate through transparent evidence and clearly separated processing stages.