Your AI pentester is probably exfiltrating your client's data. Run it air-gapped instead.

Disclosure: I build Darkmoon, one of the tools that does this locally. But the problem is real no matter which tool you pick.

The uncomfortable default

Most autonomous AI pentesters call a hosted cloud LLM. To do their job they feed that model your targets: IPs, hostnames, request and response bodies, sometimes credentials and source. That is your client's data leaving your control, mid-engagement, to a third party. For a regulated environment it is a breach waiting to happen. For a pentest firm it is a contract violation.

"We have a DPA" is not the same as "the data never left"

A data processing agreement is paperwork. Air-gapped is physics. If the bytes never leave the machine, there is nothing to leak, subpoena, or misconfigure.

How to actually run local

1. Local inference: Ollama or llama.cpp on your own hardware. The model runs where the data is.
2. A privacy gateway: even if a step must call a remote service, tokenize sensitive values with deterministic placeholders first, then rehydrate locally. The remote side never sees real values.
3. Self-hosted everything: no vendor cloud in the loop.

Does local actually work?

Yes: 57 real vulnerabilities on OWASP Juice Shop in 28 minutes, black-box, on a local model, reproducible: https://github.com/ASCIT31/Darkmoon-Benchmarks

Darkmoon is open source and built this way: https://github.com/ASCIT31/Dark-Moon . If you run pentests for clients, "where does the model run" belongs at the top of your tooling checklist.