Skip to main content
While an AutoPT run is live, you steer it through the text field at the bottom of the session. What you type reaches the agent through one of a few input channels, and they differ in one important way: how long your instruction sticks around. Getting the channel right is the difference between a nudge the agent forgets on its next iteration and a fact it carries through the whole engagement. This page covers steering a run that’s already going. For setting up and launching a run, see the Starting your first pentest guide.

​
Plain input - a one-off nudge

Type a message with no slash command and it’s ephemeral: injected into the current iteration only. The next fresh iteration doesn’t see it. AutoPT does not sort your message into anything more durable on its own - a plain prompt is always a one-off. Use it for small, in-the-moment corrections:
  • “Slow down and confirm that finding before moving on.”
  • “Ignore the staging subdomain for now.”
  • “Try a different user-agent on that endpoint.”
If you want the instruction to survive into later iterations, don’t type it plain - use one of the commands below.

​
Making guidance stick - the slash commands

Three commands give your input a longer life than a single iteration.

​
/pin <text> - a standing note

A pin is re-injected into every iteration’s prompt and shown to the agent as authoritative pinned context. This is where durable facts belong:
  • credentials and tokens the agent should reuse
  • leaked or hard-to-find URLs
  • scope constraints (“never touch prod-db”)
  • any key fact you don’t want re-discovered every iteration

​
/unpin <id> - remove a standing note

Pins are numbered in the order you add them (1, 2, 3…). Remove one by its ID:
You can also view and remove pins from the Plugins panel on the right (Pins → List Pins / Remove Pin) - the same store the /pin command writes to.

​
/do <task> - a one-shot task

/do hands the agent a single task, queued at high priority. It runs once, gets logged, and is not repeated. Use it to redirect attention right now without leaving a standing note behind:

​
Which channel do I want?

A good habit at the start of a run: /pin the facts that define the engagement (credentials, scope limits, known URLs), then use plain input and /do to steer as you watch the thinking stream.