AI is a force multiplier for pentesters — and a liability if you don’t know where it breaks. This talk cuts through the hype with real engagement stories: what works (triage, wordlists, report drafts), what fails (hallucinated CVEs, dangerous tool flags, false confidence in code review), and what gets dangerous (data leakage, scope violations, DoS by accident, agentic AI with no guardrails). Practical techniques, honest failures, no vendor spin.