VulnGPT is an AI-assisted web application security testing product developed by NovaSecLabs. It is designed for authorized web application security assessments, functioning as an autonomous pentesting workspace. The tool focuses on reasoning about application behavior across authenticated workflows, user roles, resources, and business logic, rather than focusing solely on whether individual endpoints respond. The product features authenticated and role-aware testing, authorization boundary checks between users, and multi-step workflow and state-transition analysis. It employs an evidence-led validation methodology that keeps suspicious observations distinct from confirmed findings until evidence supports the conclusion. VulnGPT is built to test authorized interactions across users, roles, resources, and tenant boundaries. Typical use cases for VulnGPT include investigating business rules and state transitions that isolated-request scanners can miss. Practitioners use the tool to investigate application behavior and validate security findings with reproducible evidence. VulnGPT is currently available through a Private Beta application process.