Notes on autonomous AI pentesting
How we keep real infrastructure data away from the model, how the open source tooling actually compares, and what we learned building Darkmoon.
What an autonomous pentest looks like when the site is actually hardened
16 findings, zero critical, zero high, nothing exploited. The most useful report we published this week is the boring one, because it shows what the agent does when there is no way in.
Read →Static firmware analysis: 20 findings from the image alone
No device, no network, just the IoTGoat firmware image unpacked. The agent found the backdoor binary, the telnet daemon, the command injection endpoint and a Mirai default credential before anything was ever powered on.
Read →An unauthenticated root backdoor on an IoT device, found twice by two independent runs
Two separate campaigns against the same live OWASP IoTGoat appliance. Both reached root through the backdoor on port 5515, both pulled /etc/shadow, and one cracked the Mirai default credential over SSH.
Read →Auditing a GitLab instance through its own API
13 unique findings against GitLab CE 19.2.1: an admin PAT with api and sudo scopes, an unmasked AWS secret in CI/CD variables, an exposed runner registration token, open signup and no branch protection.
Read →SSRF to gopher to GCP metadata: stealing a service account token end to end
A profile image fetcher took a user supplied URL. Direct metadata access was blocked by the required header, so the agent smuggled the header through a gopher:// payload, stole the token and emptied the bucket.
Read →A GCS bucket name in an HTML comment, 500 customer records out
The bucket name was commented out in the careers page. Object fuzzing found a password protected backup archive, and the password was cracked from a wordlist built out of the same website.
Read →Reading Azure Key Vault secrets with a stolen password, then pivoting with them
Two campaigns against the same Key Vault: the first extracted three plaintext contractor passwords through over-permissive RBAC, the second reused one to authenticate as that contractor and reach customer card data.
Read →Helpdesk to Global Admin in Azure: the chain an autonomous agent reconstructed
A password in an Entra ID custom security attribute, a second one in VM userData, and Global Admin credentials in a storage blob. The agent chained four identities and captured the lab flag.
Read →Entra ID: a deleted blob, ROPC without MFA, and a tenant takeover path we did not walk
Anonymous blob versioning recovered a deleted archive with hardcoded credentials, ROPC minted a token with no MFA challenge, and Graph enumeration exposed a service principal holding Privileged Authentication Administrator.
Read →A public EBS snapshot and a public bucket: an AWS assessment with zero exploitation
9 findings against a live AWS account with a deliberately limited IAM user. Nothing was exploited and the report says so: the value here is what a constrained identity can still map, and how much of it is confirmable.
Read →Anonymous S3 listing to IT admin: a credential chain walked without a human
A publicly listable S3 bucket led to a PowerShell script with hardcoded IAM keys, which led to a credential export with six more sets, which led to an it-admin key. Five critical findings, all exploited, plus a card data exposure.
Read →Vault, a container registry and the Docker socket: one run, 41 findings
Three specialist agents dispatched in parallel against HashiCorp Vault, an OCI registry and an exposed Docker Engine socket. Root token guessed, image layers unpacked for credentials, and a container escape that read the host /etc/shadow.
Read →An exposed terraform.tfstate, and the secrets an autonomous agent pulled out of it
A Terraform state file served over plain HTTP with no authentication, an Ansible inventory in the open, and a LocalStack AWS account with an AdministratorAccess CI user. 16 unique findings, 10 of them critical.
Read →PostgreSQL COPY TO PROGRAM RCE and a MySQL 5.6 audit in one autonomous run
22 findings against PostgreSQL 16.14 and MySQL 5.6.51: command execution as the postgres user, arbitrary file read and write, password hash extraction from pg_shadow and mysql.user, and live session tokens.
Read →Redis with no password: what the agent got, and what it refused to claim
An unauthenticated Redis 7.4.10 instance assessed autonomously: 9 findings, 5 exploited. The classic RDB-write RCE was demoted to mitigated because Redis 7.x blocked it, and we published that rather than the bigger number.
Read →Jenkins with security disabled: unauthenticated script console RCE, proven end to end
A Jenkins 2.541.3 controller running with SecurityRealm None. An autonomous agent went from anonymous HTTP to code execution on the controller and exfiltrated the master encryption key. Three findings, all critical, all exploited.
Read →Shannon alternative: autonomous AI pentesting that stays local
Shannon posts an impressive white-box benchmark, but it reads your source and calls a cloud model. Here is a black-box, local-LLM alternative with a reproducible OWASP Juice Shop benchmark, plus Active Directory and Kubernetes coverage.
Read →Strix alternative: the local-first open source AI pentester
Strix is a strong open source AI pentester, but it runs against a cloud model. If you need autonomous AI penetration testing that keeps your code and traffic on your own infrastructure and also covers Active Directory and Kubernetes, here is the honest comparison.
Read →HexStrike AI alternative: from MCP tool runner to a full autonomous platform
HexStrike AI is a powerful MCP tool runner. Darkmoon ships the orchestration methodology, runs on a local LLM, keeps data off the model, and covers AD and Kubernetes. An honest comparison.
Read →PentAGI alternative: local first, with Active Directory and Kubernetes
PentAGI is a strong self hostable multi-agent pentester built around cloud LLMs. If you need a local-LLM default, a privacy gateway, and Active Directory plus Kubernetes coverage, here is the comparison.
Read →The local, self hosted AI pentester: autonomous testing without a cloud model
Most autonomous AI pentesters send your code, IPs and traffic to a hosted model. Here is how to run autonomous penetration tests entirely locally, with deterministic tokenization so nothing sensitive ever leaves.
Read →Open source XBOW alternative: self hosted, local, auditable
XBOW made autonomous AI pentesting famous, but it is closed, cloud hosted and enterprise priced. Here is the open source, self hosted, local-LLM path, with a reproducible OWASP Juice Shop benchmark.
Read →Autonomous cloud penetration testing: SSRF, metadata and service-account chains
What it takes for an AI agent to turn one SSRF or one leaked key into cloud initial access on AWS, Azure and GCP — metadata tokens, gopher smuggling, Key Vault and storage exfiltration.
Read →IoT firmware penetration testing with AI: from image to root
How an autonomous agent extracts an IoT firmware image, recovers hardcoded credentials and backdoors, and roots the live device — walked through on OWASP IoTGoat.
Read →We aimed an autonomous AI attacker at OpenNHP. On the protected plane it found nothing.
A joint, reproducible test with the OpenNHP project: Darkmoon, a fully autonomous AI pentester, run against the OpenNHP public demo. On the exposed demo surface it behaved like any capable attacker and produced 51 findings. On the NHP-protected hosts it could not even discover a target, so the attack chain never began.
Read →NodeZero alternative: the self hosted open source path
If you evaluated NodeZero or Pentera but need self hosted, auditable and open source autonomous security testing, here are the real options and the trade offs.
Read →The open source AI pentest tools worth knowing in 2026
An honest field guide to the open source autonomous AI penetration testing tools in 2026: what each one is good at, licensing, scope, and how to pick.
Read →How to run an AI pentest without sending your data to the LLM
Autonomous AI pentesting normally ships your real IPs, hostnames and credentials to a hosted model. Here is the deterministic tokenization and local rehydration design that avoids it.
Read →