Disclosure: I work on Darkmoon, the autonomous AI pentester used here. But this post is really about the defense, because the interesting result is what the attacker could NOT do. Everything is reproducible against the same public demo.
The test
OpenNHP is an open-source zero-trust tool that uses Single Packet Authorization: services stay undiscoverable unless you present valid credentials first. No discovery, no attack surface.
So I did the fair version of the test: point a fully autonomous AI attacker at OpenNHP's public demo, non-destructive, and let it do whatever it wanted. The demo has two planes:
- NHP-protected hosts (server2, access controller)
- Intentionally exposed components (a public auth plugin and helper hosts)
The numbers
Exposed surface, 51 findings: 4 high, 10 medium, 17 low, 20 informational. On the exposed side the agent behaved like any capable attacker: it enumerated, chained, and reported. Normal.
Protected plane: zero findings. Not zero exploitable findings. Zero of anything. The autonomous attacker could not even establish that a target existed.
Every discovery method timed out with no response:
-
curlover HTTP/HTTPS gave exit code 28 (timeout) - targeted
naabuscans on 22 / 80 / 443 / 8080 found nothing - raw TCP connect probes found nothing
- ICMP found nothing
Why this is the interesting part
An autonomous agent is only as good as its first step: discovery. If it cannot find the target, the entire kill chain never begins. Recon, exploitation, lateral movement, all moot. OpenNHP moves the security boundary before discovery.
The decisive detail: on the exposed side, an agent private key was served publicly in config.json. That key was the whole game. Without it, the protected host cannot be discovered or attacked at all. With it, you are inside the trust boundary. It is a clean illustration that in a zero-trust design, the credential is the attack surface, not the port.
Takeaway for builders
Most of the AI-pentest conversation is about making attackers smarter. This test is the mirror image: a smart autonomous attacker is trivially defeated by a target it cannot see. If you run internet-facing services, "reduce discoverability" belongs above "patch faster" on the list.
Credit to the OpenNHP project. The result validates their design, not ours.
Darkmoon (the tool) is open source here: https://github.com/ASCIT31/Dark-Moon. But honestly, go read how OpenNHP works first.
Top comments (1)
The most useful result here is the negative evidence: what the attacker could not see or reach. Security demos often over-focus on findings, but a protected surface producing boring, empty reconnaissance is the point. That is much more convincing when the test is reproducible.