Open source autonomous AI pentesting tools in 2026: an honest field guide

If you have looked for an open source, autonomous AI penetration testing tool in the last year, you have probably noticed the space went from empty to crowded very fast. Here is an honest field guide to the open source options in 2026, what each one is actually good at, and how to pick. No hype, no "this one wins," just the trade offs.

What "autonomous AI pentest" means here

A tool that takes a target, reasons about it with a language model, and actually runs offensive tools against it (not just suggests commands), then reports findings. The interesting axes to compare are: license, scope (web only vs web plus Active Directory, Kubernetes, cloud), whether it can run on a local model (data sovereignty), and whether findings come with proof of exploitation or just a model's opinion.

The open source landscape

• PentestGPT (github.com/GreyDGL/PentestGPT) — the one that started the wave. An interactive assistant that guides you through a pentest with an LLM. Great for learning and CTF style work; you stay in the loop and run things yourself.
• hackingBuddyGPT (github.com/ipa-lab/hackingBuddyGPT) — academic, focused and honest. Good if you want to study how far a small model gets on privilege escalation, with published numbers.
• Strix (github.com/usestrix/strix) — autonomous agents for web app testing, Apache 2.0, active and polished.
• PentAGI (github.com/vxcontrol/pentagi) — an autonomous framework with an orchestrator and a memory graph, container based.
• CAI, Cybersecurity AI (github.com/aliasrobotics/cai) — a framework for building autonomous security testing agents, from Alias Robotics, with its own benchmark work.
• Darkmoon (github.com/ASCIT31/Dark-Moon) — GPL-3.0 platform and MCP host with per technology offensive sub agents (GraphQL, Spring, .NET, Node, PHP, Ruby, WordPress) plus Active Directory and Kubernetes, an evidence trail on every finding, and a local 14B model option. Its distinguishing piece is a Privacy Gateway (below).
• Worth knowing but not open source: XBOW (topped a HackerOne leaderboard, closed), and the commercial validation vendors NodeZero / Horizon3 and Pentera.

How to actually choose

1. Do you need more than web? Most of these focus on web app testing. If your reality includes Active Directory and Kubernetes, that narrows the field fast.
2. Can you send target data to a hosted model? For a lot of teams the answer is no. Then you want a tool that runs on a local model, or one that never sends real sensitive values to the model at all.
3. Do you trust a finding without proof? An LLM saying "this looks like SQLi" is not the same as a tool that executed the payload and kept the evidence. Prefer proof of exploitation.
4. License matters if you plan to self host, modify, and audit. GPL and Apache are not the same commitment.

The data sovereignty problem, and one answer

The blocker nobody advertises: the moment an autonomous agent sends real IPs, hostnames, credentials or internal paths to a hosted model, sensitive facts about your infrastructure leave your perimeter. For regulated and defense teams that alone kills the approach.

Darkmoon's Privacy Gateway is one concrete answer, and its core is open source. The model only ever sees deterministic placeholders (IP_PRIVATE_001, HOST_INTERNAL_001, EMAIL_001). The real values are reinjected locally just before a tool runs, then masked again before anything returns to the model, and any exfiltration attempt is blocked. We validated it end to end on OWASP Juice Shop with the gateway active the whole run: 56 vulnerabilities found while the model never saw a single real IP. If you are building agentic security tooling, the pattern generalizes: keep the reasoning on a capable model, keep the secrets on your side.

Bottom line

The honest summary: PentestGPT and hackingBuddyGPT are where you learn, Strix and PentAGI and CAI are strong autonomous web frameworks, and if your constraints are Active Directory plus Kubernetes plus strict data privacy, look at Darkmoon. All of these are open source, so the best move is to clone the two or three that fit your reality and run them against a lab.

Repos again: PentestGPT github.com/GreyDGL/PentestGPT, Strix github.com/usestrix/strix, PentAGI github.com/vxcontrol/pentagi, CAI github.com/aliasrobotics/cai, hackingBuddyGPT github.com/ipa-lab/hackingBuddyGPT, Darkmoon github.com/ASCIT31/Dark-Moon.