Tagged: pentest-agents
9 posts · browse all tags
-
The Judgment Gap Just Got Numbers: Two 2026 Surveys on AI Pentesting Tools
The AI Pentest Agents series closed by arguing these tools need a human checking their work, not replacing it. Two independent surveys published within weeks of that series wrapping just put real numbers on exactly that gap.
-
AI Pentest Agents Part 1: From Assistant to Autonomous Swarm
A new wave of AI pentesting agents landed in the space of two weeks in July 2026. This opens a series on what they actually do, how they differ from each other, and how they differ from the raw LLM-plus-nmap-plus-Metasploit approach this site already tried in AI Part 7.
-
AI Pentest Agents Part 2: Inside PentestCode's Coordinator and Engagement State
A close read of PentestCode's actual README: the strategist-coordinator design, the thirteen agents, the engagement-state graph with Dijkstra/Yen's K-shortest attack paths, the eighteen mandatory tools, and the honest limitations section the project ships with itself.
-
AI Pentest Agents Part 3: PentestGPT and the Academic Case for Reasoning, Generation, Parsing
PentestGPT is the oldest project in this series by a wide margin — a USENIX Security 2024 paper before it was a product. What its three-module design got right early, what changed in its 2026 agentic rewrite, and what its own published benchmark numbers actually say.
-
AI Pentest Agents Part 4: PentAGI and the Cost of Docker Root
PentAGI takes the opposite infrastructure bet from PentestCode: full Docker sandboxing instead of a root-free binary, which buys real isolation at the cost of a docker.sock privilege model worth understanding before you install it.
-
AI Pentest Agents Part 5: NodeZero, XBOW, and What Production-Safe Actually Means
NodeZero and XBOW aren't developer tools you install — they're commercial platforms with real production track records, real customers, and a review-before-submission discipline the open-source entrants in this series don't have to answer to.
-
AI Pentest Agents Part 6: Fingerprinting the Swarm, a Defender's Read on Agent Noise
PentestCode's own README admits it isn't stealthy and repeats work it's already done. What does that actually look like on the wire, and does it give a defender anything a human red-teamer wouldn't?
-
AI Pentest Agents Part 7: Installing PentestCode, and Where the Sandbox Runs Out of Road
The sandbox verified PentestCode's root-free install claim, then ran out of road on an LLM credential. The real run happened on the Proxmox lab: three independent root vectors on Metasploitable2, $9.64, and a critic agent that caught a real technical error.
-
AI Pentest Agents Part 8: Does the Human Pentester Still Have a Job
Closing out the series: what changes for a working pentester when tools like this exist, why every project in this series still insists on a human in the loop somewhere, and how this question echoes the one this site already asked about Ansible.