· 7 min read
If you have looked for an open source, autonomous AI penetration testing tool in the last year, you have noticed the space went from empty to crowded fast. Here is an honest field guide: what each project is actually good at, and how to choose. No hype, no "this one wins".
What counts as an autonomous AI pentest tool
For this guide: a tool that takes a target, reasons about it with a language model, and actually runs offensive tooling against it rather than only suggesting commands, then reports findings. The axes that matter are licence, scope (web only, or web plus Active Directory, Kubernetes and cloud), whether it can run on a local model, and whether findings come with proof of exploitation or just a model's opinion.
The landscape
- PentestGPT — the project that started the wave. An interactive assistant that guides you through a pentest. Excellent for learning and CTF style work; you stay in the loop and run things yourself.
- hackingBuddyGPT — academic, focused and honest. Good if you want to study how far a small model gets on privilege escalation, with published numbers.
- Strix — autonomous agents for web application testing, Apache 2.0, active and polished.
- PentAGI — an autonomous framework with an orchestrator and a memory graph, container based.
- CAI (Cybersecurity AI) — a framework for building autonomous security testing agents, with its own benchmark work.
- Shannon — autonomous web application testing with a built in browser to execute real exploits.
- Darkmoon — GPL-3.0 platform and MCP host with per technology offensive sub agents, plus Active Directory and Kubernetes, an evidence trail on every finding, and a local model option. Its distinguishing piece is the privacy gateway (below). Full disclosure: this is our project.
Worth knowing but not open source: XBOW (which famously topped a HackerOne leaderboard) and the commercial validation vendors NodeZero and Pentera.
How to actually choose
- Do you need more than web? Most of these focus on web application testing. If your reality includes Active Directory and Kubernetes, that narrows the field quickly.
- Can you send target data to a hosted model? For many teams the answer is simply no. Then you want a tool that runs on a local model, or one that never sends real sensitive values to the model at all.
- Do you trust a finding without proof? A model saying "this looks like SQLi" is not the same as a tool that executed the payload and kept the evidence. Prefer proof of exploitation.
- Licence matters if you plan to self host, modify and audit. GPL and Apache are not the same commitment.
The data sovereignty problem, and one answer
The blocker nobody advertises: the moment an autonomous agent sends real IPs, hostnames, credentials or internal paths to a hosted model, sensitive facts about your infrastructure leave your perimeter. For regulated and defence teams that alone kills the approach.
Darkmoon's privacy gateway is one concrete answer, and its core is open source. The model only ever sees deterministic placeholders; real values are reinjected locally just before a tool runs, then masked again before anything returns to the model, and exfiltration attempts are blocked. We validated it end to end on OWASP Juice Shop with the gateway active the whole run: 56 vulnerabilities found while the model never saw a single real IP. If you are building agentic security tooling, the pattern generalises. We wrote up the design in how to run an AI pentest without sending your data to the LLM.
Bottom line
PentestGPT and hackingBuddyGPT are where you learn. Strix, PentAGI, CAI and Shannon are strong autonomous web frameworks. If your constraints are Active Directory plus Kubernetes plus strict data privacy, look at Darkmoon. All of these are open source, so the honest recommendation is to clone the two or three that fit your reality and run them against a lab you own, rather than trust any article, including this one.