Gains:
- Ability to understand the human curiosity-based nature of exploratory testing and use artificial intelligence as a partner to generate test charters and intuitive clues
- Ability to diversify discovery axes such as input, timing, format, authorization and interruption and record each anomaly with the production step again
- Ability to apply the limit of using AI only in preparation and wrap-up while the discovery session itself is conducted by humans
Every test case written checks something that has already been thought about. But the most dangerous mistakes often hide in places no one has thought of before. Exploratory testing — a testing approach in which the tester simultaneously learns, designs and runs the product by exploring it, without relying on a pre-written script — targets exactly this gap. In exploratory testing, the expert plays freely with the product, asks “what if I do this,” and catches unexpected behavior of the system. This is the type of testing that relies most on human intuition and curiosity — and that's exactly why the role of artificial intelligence (AI) here is not to "replace" but to amplify curiosity, evoke blind spots, and generate ideas.
In this unit you will learn how to use AI as an exploratory testing partner: from printing test charters, evoking heuristics, to summarizing post-session notes.
Why is exploratory testing still human work?
Scripted testing — a test with steps written in advance and repeated verbatim — confirms what is known; Exploratory testing searches for the unknown. The value in exploratory testing comes from the moment the tester sees the product and senses "there's something weird here." AI cannot see the product the way you see it, it cannot sense what would bother the real user, it cannot be disturbed by saying "this button is in the wrong place". But AI is a very powerful aid in three ways: (1) producing systematic lists of test ideas, (2) reminding you of test axes you have forgotten, (3) turning your scattered discovery notes into an organized report.
Tip: Ask the AI for a “test idea warm-up” before starting the discovery session; Do not leave the screen to the AI during the session. AI is helpful before and after the session; The session itself is driven by your curiosity.
Heuristics and AI
Exploratory testers use heuristics, which are short reminders that provide direction in the bug hunt. AI can remind you of these by adapting them to your context. A few classics:
- CRUD: Try the Create, Read, Update, Delete flow for each data; interrupt someone.
- Goldilocks (little/full/lot): Enter very little, full and a lot of data in a field (0 characters, 1 character, 10,000 characters).
- CRUD + scheduling: Edit the same record in two tabs at once, then save both.
- Interrupt: Refresh page mid-action, disconnect network, press backspace.
- Reverse order: Do the steps in reverse order (pay first, then add to cart).
When you tell the AI to “suggest concrete trials by applying these intuitive cues for that screen,” you get a field-ready checklist.
Writing a test condition (charter)
Exploratory testing is not about wandering; It is focused on the test charter (a short directive that defines what an exploration session will explore and for what purpose). A good charter follows this pattern: “Explore [target domain], using [tools/data], to uncover [what information/risk].” AI quickly drafts these terms.
Balancing scripted testing with exploratory testing
A sound testing strategy uses a combination of scripted (automated, repeatable) testing and exploratory testing. Scripted tests cheaply verify that known behaviors are not broken, version after version; Exploratory testing, on the other hand, looks for new risks that these scripts have never considered. The two are not competitors, but complements. A common mistake is to think “let's automate everything so there is no need for discovery”; whereas automation only checks for what you already know, it can never find what you don't know. Another mistake is the opposite: relying on manual discovery with each release without setting up any automation — this leads to the same basic bugs creeping in over and over again.
AI helps establish this balance: you can turn an anomaly you find in your discovery session into a permanent scripted regression test by giving it to AI. Thus, the error once discovered in discovery can never return undetected again. Discovery takes care of “find the new risk”, automation takes care of “don't let go of the found”; AI accelerates the bridge between the two.
Tip: Separate the output of each discovery session into two buckets: “bugs to fix immediately” and “scenarios to turn into permanent automation.” The second bucket carries the long-term value of the discovery into your regression package.
Weak prompt / Strong prompt
Weak: "What should I test on this screen?"
Strong: "For a 'profile photo upload' feature, divide the 90-minute exploratory testing session into 3 test conditions. For each condition: give the target, intuitive clues to use (file size/format/goldilocks/truncation), 5 concrete actions to try, and risk signals to look out for (slowdown, corrupted image, security). Especially address the risks of malicious file uploads (too large file, wrong extension) defensively."
Powerful prompt; gives duration, structure, clues and risk focus. The result is a road map you'll keep handy throughout the session.
Exploration axes table
axis
question to ask
sample essay
Input limits
What does the field do at extreme values?
10,000 character name
timing
What happens in concurrent/interrupted processing?
Save the same record in two tabs
Format
How to handle the unexpected format?
Emoji, right-to-left text, HTML
authority
Can unauthorized user access?
Change URL manually
Status
Is an invalid state transition possible?
Try to pay for canceled order
deduction
Is the data consistent when the network/session is interrupted?
Cut network while recording
Four copyable templates
1) Test condition generator:
Your role: senior exploratory tester. Split [duration] minute exploratory session into 3-4 testing conditions for feature:[feature]. Each condition: goal, intuitive clues to use, 5 concrete actions to try, risk signals to watch. Condition pattern: "Explore [domain] with [tool/data] for [risk/information]."
2) Intuitive cue adapter:
Translate these intuitive clues into concrete experiments for the following screen: CRUD, goldilocks (less/full/more), interrupt, reverse order, bypass authorization. Screen: [screen/flow description]. Write 2 screen-specific experiments for each clue.
3) Blind spot reminder:
I'm testing the following feature: [feature].List the 10 cases where experienced testers MOST miss this type of feature. Include accessibility, localization (language/date/currency), concurrency, security and performance axes.
4) Session note summarizer:
Below are the raw notes from my discovery session. Organize them in this structure: - Anomalies found (with estimated severity) - Those with a known reproduction step - Those that require further investigation - Suggestion for the next session Raw notes: [paste notes]
three mini cases
Case 1 — Blind spot reminder in action. An expert was testing the search feature in a multilingual application. Upon AI's reminder to "don't forget the localization axis", he tried the Turkish-specific "i/I" letter conversion. Searching for "Istanbul" did not yield any results; A lowercase conversion error was detected. AI axis reminded, the expert tried and found it.
Case 2 — Focus of the charter. A new tester spent 2 hours "surfing" through a payment screen but only made 2 small notes because it was unstructured. After planning a session with the AI divided into 3 test conditions, it recorded 11 anomalies in the same period; two of them were serious. The same time was 5 times more efficient thanks to the structure.
Case 3 — Defensive file upload testing. A team tried the "wrong extension/too large file" suggested by YZ in uploading a profile photo, within their own products. Found that a 50 MB file crashed the server for 40 seconds and added a size limit and timeout. The testing was done only on its own products, for defensive purposes.
Common mistakes
- Replacing AI with session. The value of discovery is in your observation and intuition; AI helps with preparation and recovery.
- Browse without reservation. Spending hours without focus and finding little. The test condition gives focus.
- Not collecting notes. If you do not save the anomaly found in the discovery with the production step again, that finding will be lost.
- Being stuck on one axis. Always testing the limits of input; Bypassing authority, scheduling, localization axes.
- Conducting unauthorized security tests. Only attempt file/URL manipulation on your own product and with permission.
In summary
Exploratory testing is the type of testing that relies most on human curiosity, searching for the unwritten. AI will not replace you here; It outlines test conditions, adapts intuitive clues to your context, reminds you of blind spots, and turns your messy session notes into an organized report. Value comes from your observation and intuition; AI focuses and multiplies this value. Write conditions, vary the axes, record the findings with the production step again, perform security tests only within authorization.
Application task
Choose a feature from your own product. Divide the 60 minute session into 3 conditions using the “test condition generator” template with AI. Do the session (without AI, exploring by hand), keep raw notes. When finished, organize the notes with the “session note summarizer” template. Result: at least 5 anomalies, regeneration step for each and severity estimate. Note which test condition and intuitive clue resulted in the most valuable anomaly you found.
checklist
- [ ] Before the session, I created test conditions with AI and determined the focus.
- [ ] I tried at least 4 different axes of discovery (input, timing, format, authorization, interruption).
- [ ] I conducted the session manually, with my own curiosity; I did not replace AI.
- [ ] I recorded each anomaly with its reproduction step and severity estimate.
- [ ] I turned my notes into a regular report with AI.
- [ ] I have only attempted security/manipulation on my own product and with authorization.