If I understand the product correctly, you're suggesting customers opt into letting an LLM pentest their testing systems, and allowing that LLM to generate and carry out plans of attack.
Imagine a recurring revenue business that keeps tokens for user credit cards on file, and then a dev naively gives the CI infrastructure an ability to call out/proxy some calls to production in a privileged way, and then Escape finds a way to break out of CI and charge cards on the production system. Of course, this is a massive security issue in and of itself, but at a certain point, a human pentester would know "holy ** I should stop what I'm doing right now." How do we know that Escape won't keep fuzzing and fuzzing and exacerbate the situation, causing real-world impact to customers?
There's probably a philosophical take on this - that security by obscurity is no security at all, and that threat actors will be every bit as good at this as Escape's technology is. But for any business that's not really a dedicated target for actors (say, only gets drive-by script kiddies that are easily fended off by keeping software up to date) using Escape might be increasing their risk of a breach that is meaningful to their customers, by inviting the scrutiny of a well-funded LLM, with a laser focus only on your specific business, that doesn't know when to stop.