Comparing AI agents to cybersecurity professionals in real-world pen testing