Notes on autonomous AI pentesting
How we keep real infrastructure data away from the model, how the open source tooling actually compares, and what we learned building Darkmoon.
Pentesting an LLM without leaking your own infrastructure to the LLM
Why an offensive LLM-endpoint agent ships with privacy-gateway hardening: pre-model prompt tokenization from terminal and UI, server-side report rehydration and a per-session override, measured on a real run where the model saw the target 0 times across 3.5 MB of traffic.
Read →How the Darkmoon LLM agent pentests an AI inference endpoint, with garak
Auto-detection of OpenAI-compatible, Ollama, vLLM and TGI endpoints, dispatch like the GraphQL and Kubernetes agents, then fingerprint, capability profiling, an optional bounded garak pass and adaptive OWASP-LLM attacks with a per-run canary and explicit detectors, bounded throughout to avoid denial of service.
Read →LLM endpoint penetration testing: 8 OWASP LLM Top 10 findings, proven end to end
Darkmoon's new llm agent detected an OpenAI-compatible endpoint and found 8 distinct issues mapped to the OWASP LLM Top 10: system-prompt leakage with hardcoded credentials, prompt injection and jailbreak, insecure output handling, unbounded consumption, SSRF and unauthenticated access, each with the exact request and raw response.
Read →Autonomous web app pentest against OWASP Juice Shop: 7 findings, 4 exploited with proof
An authorized autonomous scan of a locally hosted OWASP Juice Shop: UNION SQL injection that dumped the user table, a login authentication bypass that minted an admin JWT, null-byte path traversal, a stored-XSS sanitizer bypass, JWT hash exposure and verbose errors, each graded EXPLOITED or CONFIRMED by demonstrated impact.
Read →PentestGPT alternative: from an LLM advisor to an autonomous, local pentester
PentestGPT is an excellent LLM assistant that guides a human operator through a test. If you want the model to actually run the engagement, through a controlled tool layer, on a local model, with Active Directory and Kubernetes coverage and proof per finding, here is the honest comparison.
Read →Continuous pentesting for NIS2 and DORA: why one audit a year is not enough
NIS2 and DORA push regulated organisations toward regular testing of their security measures, not a single annual snapshot. Here is why point-in-time pentests age badly against a moving estate, and how autonomous, repeatable testing complements the mandatory human red team without replacing it.
Read →From finding to fix: autonomous remediation with human-reviewed pull requests
Darkmoon's Pro remediation agent turns each confirmed finding into a minimal fix: it reproduces the exploit against a fresh build, patches the root cause, re-runs the exploit and its variants plus the repo's tests in an ephemeral Docker sandbox, then opens a pull request for human review. It never merges on its own.
Read →Why proof of exploitation beats AI vulnerability scores
AI vulnerability scanners hand you scores and probabilities. Here is why proof of exploitation, with the exact payload and raw output, is what a buyer should demand.
Read →Pentesting Kafka, RabbitMQ and MQTT with AI agents: the broker as the shortest path to your data
Autonomous security testing for Kafka, RabbitMQ and MQTT: management APIs, anonymous access, weak topic authorization and secrets, with proof of impact.
Read →Terraform and Ansible security: from an IaC misconfiguration to a proven attack path
Static IaC scanners flag Terraform and Ansible misconfigurations. Darkmoon's terraform and ansible agents prove which ones chain into an obtained credential.
Read →Autonomous penetration testing in your CI/CD pipeline
Wire autonomous penetration testing into CI/CD: run Darkmoon on an ephemeral environment, gate the build on exploited findings, and attach a proof report.
Read →Beyond WPScan: autonomous AI penetration testing for WordPress and five more CMS platforms
Autonomous AI penetration testing for WordPress, Drupal, Joomla, Magento, PrestaShop and Moodle. Six dedicated agents that prove exploitation instead of matching versions.
Read →GraphQL penetration testing beyond introspection: BOLA, batching and mutations, proven
GraphQL penetration testing past introspection: BOLA and IDOR through node IDs, query batching and alias brute force, depth and complexity abuse, and mutation testing.
Read →Active Directory penetration testing with autonomous AI: BloodHound, Kerberoasting, DCSync and ADCS
How the Darkmoon active-directory agent runs AD penetration testing end to end: BloodHound attack paths, AS-REP and Kerberoasting, DCSync, and ADCS ESC1 to ESC16.
Read →Autonomous API penetration testing: JWT abuse, BOLA and real attack chains
Autonomous API penetration testing that maps the surface, abuses JWTs, finds BOLA, reuses tokens and chains findings into real impact, with proof for each step.
Read →Multi-agent AI penetration testing without giving the model a shell
How multi-agent AI reshapes autonomous penetration testing: a controlled MCP tool layer, credential-gated dispatch of specialist agents, and a bounded executor.
Read →Kubernetes penetration testing with AI: from a mounted token to root on the node
How an autonomous agent walks a Kubernetes cluster: RBAC abuse, ServiceAccount token theft, kubelet API, secrets, container escape, each proven when executed.
Read →What an autonomous pentest looks like when the site is actually hardened
16 findings, zero critical, zero high, nothing exploited. The most useful report we published this week is the boring one, because it shows what the agent does when there is no way in.
Read →Static firmware analysis, case study: 20 findings without ever powering the device
No device, no network, just the IoTGoat firmware image unpacked. The agent found the backdoor binary, the telnet daemon, the command injection endpoint and a Mirai default credential before anything was ever powered on.
Read →Live device case study: an unauthenticated root backdoor, found twice by two independent runs
Two separate campaigns against the same live OWASP IoTGoat appliance. Both reached root through the backdoor on port 5515, both pulled /etc/shadow, and one cracked the Mirai default credential over SSH.
Read →Auditing a GitLab instance through its own API
13 unique findings against GitLab CE 19.2.1: an admin PAT with api and sudo scopes, an unmasked AWS secret in CI/CD variables, an exposed runner registration token, open signup and no branch protection.
Read →SSRF to gopher to GCP metadata: stealing a service account token end to end
A profile image fetcher took a user supplied URL. Direct metadata access was blocked by the required header, so the agent smuggled the header through a gopher:// payload, stole the token and emptied the bucket.
Read →A GCS bucket name in an HTML comment, 500 customer records out
The bucket name was commented out in the careers page. Object fuzzing found a password protected backup archive, and the password was cracked from a wordlist built out of the same website.
Read →Reading Azure Key Vault secrets with a stolen password, then pivoting with them
Two campaigns against the same Key Vault: the first extracted three plaintext contractor passwords through over-permissive RBAC, the second reused one to authenticate as that contractor and reach customer card data.
Read →Helpdesk to Global Admin in Azure: the chain an autonomous agent reconstructed
A password in an Entra ID custom security attribute, a second one in VM userData, and Global Admin credentials in a storage blob. The agent chained four identities and captured the lab flag.
Read →Entra ID: a deleted blob, ROPC without MFA, and a tenant takeover path we did not walk
Anonymous blob versioning recovered a deleted archive with hardcoded credentials, ROPC minted a token with no MFA challenge, and Graph enumeration exposed a service principal holding Privileged Authentication Administrator.
Read →A public EBS snapshot and a public bucket: an AWS assessment with zero exploitation
9 findings against a live AWS account with a deliberately limited IAM user. Nothing was exploited and the report says so: the value here is what a constrained identity can still map, and how much of it is confirmable.
Read →Anonymous S3 listing to IT admin: a credential chain walked without a human
A publicly listable S3 bucket led to a PowerShell script with hardcoded IAM keys, which led to a credential export with six more sets, which led to an it-admin key. Five critical findings, all exploited, plus a card data exposure.
Read →Vault, a container registry and the Docker socket: one run, 41 findings
Three specialist agents dispatched in parallel against HashiCorp Vault, an OCI registry and an exposed Docker Engine socket. Root token guessed, image layers unpacked for credentials, and a container escape that read the host /etc/shadow.
Read →An exposed terraform.tfstate, and the secrets an autonomous agent pulled out of it
A Terraform state file served over plain HTTP with no authentication, an Ansible inventory in the open, and a LocalStack AWS account with an AdministratorAccess CI user. 16 unique findings, 10 of them critical.
Read →PostgreSQL COPY TO PROGRAM RCE and a MySQL 5.6 audit in one autonomous run
22 findings against PostgreSQL 16.14 and MySQL 5.6.51: command execution as the postgres user, arbitrary file read and write, password hash extraction from pg_shadow and mysql.user, and live session tokens.
Read →Redis with no password: what the agent got, and what it refused to claim
An unauthenticated Redis 7.4.10 instance assessed autonomously: 9 findings, 5 exploited. The classic RDB-write RCE was demoted to mitigated because Redis 7.x blocked it, and we published that rather than the bigger number.
Read →Jenkins with security disabled: unauthenticated script console RCE, proven end to end
A Jenkins 2.541.3 controller running with SecurityRealm None. An autonomous agent went from anonymous HTTP to code execution on the controller and exfiltrated the master encryption key. Three findings, all critical, all exploited.
Read →Shannon alternative: autonomous AI pentesting that stays local
Shannon posts an impressive white-box benchmark, but it reads your source and calls a cloud model. Here is a black-box, local-LLM alternative with a reproducible OWASP Juice Shop benchmark, plus Active Directory and Kubernetes coverage.
Read →Strix alternative: the local-first open source AI pentester
Strix is a strong open source AI pentester, but it runs against a cloud model. If you need autonomous AI penetration testing that keeps your code and traffic on your own infrastructure and also covers Active Directory and Kubernetes, here is the honest comparison.
Read →HexStrike AI alternative: from MCP tool runner to a full autonomous platform
HexStrike AI is a powerful MCP tool runner. Darkmoon ships the orchestration methodology, runs on a local LLM, keeps data off the model, and covers AD and Kubernetes. An honest comparison.
Read →PentAGI alternative: local first, with Active Directory and Kubernetes
PentAGI is a strong self hostable multi-agent pentester built around cloud LLMs. If you need a local-LLM default, a privacy gateway, and Active Directory plus Kubernetes coverage, here is the comparison.
Read →The local, self hosted AI pentester: autonomous testing without a cloud model
Most autonomous AI pentesters send your code, IPs and traffic to a hosted model. Here is how to run autonomous penetration tests entirely locally, with deterministic tokenization so nothing sensitive ever leaves.
Read →Open source XBOW alternative: self hosted, local, auditable
XBOW made autonomous AI pentesting famous, but it is closed, cloud hosted and enterprise priced. Here is the open source, self hosted, local-LLM path, with a reproducible OWASP Juice Shop benchmark.
Read →Autonomous cloud penetration testing: SSRF, metadata and service-account chains
What it takes for an AI agent to turn one SSRF or one leaked key into cloud initial access on AWS, Azure and GCP — metadata tokens, gopher smuggling, Key Vault and storage exfiltration.
Read →IoT firmware penetration testing with AI: the method
The full methodology an autonomous agent follows on embedded targets, from unpacking an image to rooting a live appliance. Start here, then read the two case studies: the static image analysis and the live device run.
Read →We aimed an autonomous AI attacker at OpenNHP. On the protected plane it found nothing.
A joint, reproducible test with the OpenNHP project: Darkmoon, a fully autonomous AI pentester, run against the OpenNHP public demo. On the exposed demo surface it behaved like any capable attacker and produced 51 findings. On the NHP-protected hosts it could not even discover a target, so the attack chain never began.
Read →NodeZero alternative: the self hosted open source path
If you evaluated NodeZero or Pentera but need self hosted, auditable and open source autonomous security testing, here are the real options and the trade offs.
Read →The open source AI pentest tools worth knowing in 2026
An honest field guide to the open source autonomous AI penetration testing tools in 2026: what each one is good at, licensing, scope, and how to pick.
Read →How to run an AI pentest without sending your data to the LLM
Autonomous AI pentesting normally ships your real IPs, hostnames and credentials to a hosted model. Here is the deterministic tokenization and local rehydration design that avoids it.
Read →