Autonomous pentesting

LLM agents running the full offensive chain against a target — reconnaissance, exploitation, post-exploitation — and validating what they find by making it work. strix is this spoke’s first source for it, and it widens the corpus beyond intelligence gathering into intelligence acting on.

What changes when the agent acts

ai-osint automates collection: the analyst stops running tools by hand and a model assembles the profile. Autonomous pentesting automates the step after, and three things change with it.

The oracle problem goes away. An OSINT profile is a set of assertions nobody verifies; a working exploit verifies itself. That’s why strix can promise “PoCs, not false positives” where the profiling tools can only assert. Offensive testing has ground truth available in a way recon does not — which is a genuine epistemic advantage, and one that stops at false negatives: nothing tells you what the agents missed.

Recon demotes to a subroutine. Subdomain enumeration and attack-surface mapping, the whole subject of tools like swaggerspy and half of osint‘s classic stack, become one specialist agent’s job inside a longer chain. The infrastructure recon this spoke documents is phase one of something that no longer stops there.

Chaining becomes the point of multi-agent design. kallisto-osinter‘s agents divide reading; strix‘s divide the kill chain, and share discoveries so one agent’s foothold becomes another’s starting position. Orchestration stops being a token-efficiency trick and becomes the thing that reproduces how a red team actually works.

Continuous, and pointed at yourself

The delivery model that makes this defensive rather than offensive is CI: run the agent against your own application on every pull request, fail the build on a validated finding, ship the patch. At that point “pentest” stops describing an engagement a few times a year and starts describing a test suite. It’s the same inversion myip represents for recon — the identical capability, aimed by the subject at itself.

The governance gap

Authorization is the whole ethical boundary of this practice, and it lives entirely in prose. The tooling is Apache-2.0, installable in one line, and runnable on a consumer LLM subscription or a local model; strix‘s scope control is a warning in the README. Nothing technical distinguishes “my staging environment” from someone else’s production. Regulation of the capability sits with ../ai-governance-wiki; what belongs here is the observation that the cost floor for automated exploitation has fallen to a subscription, and consent remains a convention.

Related

strix · ai-osint · osint · ip-reconnaissance · swaggerspy · kallisto-osinter · myip · synthesis