Autonomous pentesting
LLM agents running the full offensive chain against a target — reconnaissance, exploitation, post-exploitation — and validating what they find by making it work. strix is this spoke's first source for it, and it widens the corpus beyond intelligence gathering into intelligence acting on.
What changes when the agent acts
ai-osint automates collection: the analyst stops running tools by hand and a model assembles the profile. Autonomous pentesting automates the step after, and three things change with it.
The oracle problem goes away. An OSINT profile is a set of assertions nobody verifies; a working exploit verifies itself. That's why strix can promise "PoCs, not false positives" where the profiling tools can only assert. Offensive testing has ground truth available in a way recon does not — which is a genuine epistemic advantage, and one that stops at false negatives: nothing tells you what the agents missed.
Recon demotes to a subroutine. Subdomain enumeration and attack-surface mapping, the whole subject of tools like swaggerspy and half of osint's classic stack, become one specialist agent's job inside a longer chain. The infrastructure recon this spoke documents is phase one of something that no longer stops there.
Chaining becomes the point of multi-agent design. kallisto-osinter's agents divide reading; strix's divide the kill chain, and share discoveries so one agent's foothold becomes another's starting position. Orchestration stops being a token-efficiency trick and becomes the thing that reproduces how a red team actually works.
Continuous, and pointed at yourself
The delivery model that makes this defensive rather than offensive is CI: run the agent against your own application on every pull request, fail the build on a validated finding, ship the patch. At that point "pentest" stops describing an engagement a few times a year and starts describing a test suite. It's the same inversion myip represents for recon — the identical capability, aimed by the subject at itself.
The governance gap
Authorization is the whole ethical boundary of this practice, and it lives entirely in prose. The
tooling is Apache-2.0, installable in one line, and runnable on a consumer LLM subscription or a
local model; strix's scope control is a warning in the README. Nothing technical distinguishes
"my staging environment" from someone else's production. Regulation of the capability sits with
../ai-governance-wiki; what belongs here is the observation that the cost floor for automated
exploitation has fallen to a subscription, and consent remains a convention.
What the autonomous tools replaced
The non-autonomous version of this work is still what most of it looks like: cariddi crawls a domain list and greps everything it fetches for endpoints, secrets and API keys — the same attack-surface enumeration, done by a program that decides nothing. The interesting comparison is not capability but where judgement sits. Cariddi's operator picks the targets, reads the output and decides what matters; an autonomous agent claims all three. Nobody has measured whether the second one is better at any of them, which is this spoke's standing complaint about the whole category.
Partly answered 2026-08-30, and not in the tools' favour. The absence-claim queue turned up the first comparison this spoke has seen: Escape ran four agentic pentesting tools against a deliberately vulnerable app with 20 known vulnerabilities, grey-box, one run each — Escape 15/20, PentAGI 9/20, Shannon 6/20, Strix 1/20 (detail and caveats on strix).
Three qualifications, and they matter more than the ranking. The benchmark is published by Escape, whose own product wins it — the vendor-runs-the-comparison shape, so T3 rather than independent. It compares autonomous tools against each other, not against the operator-driven baseline this section is actually about, so the paragraph above stands unanswered on its own terms. And Strix and Shannon share a model (DeepSeek v3.2) yet score 5% against 30%, which says the harness decides the outcome — an agentic-tooling finding arriving from the security side.
What it does establish is that the category's spread is enormous and the marketing is uniform. "Act just like real hackers" and 1-in-20 are the same tool.
Related
strix · ai-osint · osint · ip-reconnaissance · swaggerspy · cariddi · kallisto-osinter · myip · synthesis