The latest articles on DEV Community by Intelliflame (@intelliflame). https://dev.to/intelliflame https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4166631%2F6e94406f-3b12-4026-bae3-d9383f9a230f.png https://dev.to/intelliflame en Intelliflame Wed, 07 Oct 2026 03:33:36 +0000 https://dev.to/intelliflame/meet-bugtraceai-an-open-source-self-hosted-agentic-pentester-4ln0 https://dev.to/intelliflame/meet-bugtraceai-an-open-source-self-hosted-agentic-pentester-4ln0 <p>Every security team knows the pattern: you want a proper assessment of an app, but the options are waiting weeks for a consultancy slot, or stitching together a dozen tools and babysitting them for days. Bug bounty hunters know a variant of the same problem — the toolchain is powerful but fragmented, and every judgement call is on you.</p> <p>We are building a third option. <strong>BugTraceAI</strong> is an open-source, self-hosted framework for authorized bug bounty and penetration testing. It runs an autonomous agentic pipeline: AI agents plan and prioritize the work, specialist tools and browser validation collect the evidence, and every finding comes out with something you can verify before you file it.</p> <h2> Why "agentic" matters here </h2> <p>Plenty of scanners already automate checks. The gap BugTraceAI aims at is the layer above: deciding what to test, in what order, and what to do with ambiguous signals.</p> <p>In BugTraceAI, agents drive a six-phase pipeline:</p> <ol> <li> <strong>Recon</strong> — crawl the target and discover endpoints</li> <li> <strong>Discovery</strong> — analyze URLs and collect initial findings</li> <li> <strong>Strategy</strong> — consolidate findings and route work to specialists</li> <li> <strong>Exploit</strong> — run specialist checks and collect evidence</li> <li> <strong>Validate</strong> — verify findings before they reach the report</li> <li> <strong>Report</strong> — generate structured, human-readable deliverables</li> </ol> <p>The AI reasons and prioritizes; deterministic security tools (including Go fuzzers and browser-based validation via Playwright) adjudicate. The design principle in one line: <strong>AI output is a hypothesis — evidence makes it a finding.</strong></p> <h2> Four components, one ecosystem </h2> <ul> <li> <strong>BugTraceAI-CLI</strong> — the autonomous scanner: terminal workspace (TUI), REST API and MCP, multi-agent pipeline with specialist tools</li> <li> <strong>BugTraceAI-WEB</strong> — browser dashboard with 20+ AI security tools, real-time scan monitoring and a CLI control center</li> <li> <strong>BugTraceAI-API</strong> — evidence-first API security testing service over REST and MCP</li> <li> <strong>BugTraceAI-Launcher</strong> — guided deployment: Wizard or AI-assisted setup, local or Docker runtime</li> </ul> <p>Plus <strong>BugStore</strong> — a deliberately vulnerable practice shop with 32 planted OWASP vulnerabilities, so you can try the whole workflow legally.</p> <p>Everything is self-hosted and Apache-2.0 licensed. Scans, reports and evidence stay on your infrastructure, and analysis runs with your own LLM provider key.</p> <h2> Does it actually find things? </h2> <p>Three CVEs disclosed so far, found with BugTraceAI:</p> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Product</th> <th>CVE</th> <th>CVSS</th> </tr> </thead> <tbody> <tr> <td>Wallos</td> <td>CVE-2026-27479</td> <td>7.7 High</td> </tr> <tr> <td>ZoneMinder</td> <td>CVE-2026-27470</td> <td>8.8 High</td> </tr> <tr> <td>Piwigo</td> <td>CVE-2026-27834</td> <td>7.2 High</td> </tr> </tbody> </table></div> <p>The project was presented on stage at DEF CON 34 (Las Vegas), RootedCON 2026 (Madrid) and HKOSCon 2026 (Hong Kong). Component versions are currently in beta — treat outputs as leads to verify, not verdicts. (That is the point of the evidence-first design.)</p> <h2> Try it </h2> <ul> <li> <strong>Live demo (a real scan):</strong> <a href="https://demo.bugtraceai.com/bugtraceai" rel="noopener noreferrer">demo.bugtraceai.com</a> </li> <li> <strong>Self-host in minutes:</strong> one-command Launcher install — see the Quick Start in the <a href="https://github.com/BugTraceAI/BugTraceAI#quick-start" rel="noopener noreferrer">GitHub README</a> </li> <li> <strong>Practice target:</strong> <a href="https://bugstore.bugtraceai.com/" rel="noopener noreferrer">BugStore</a> </li> <li> <strong>Code:</strong> <a href="https://github.com/BugTraceAI" rel="noopener noreferrer">github.com/BugTraceAI</a> — if this is useful, a star helps other security folks find it</li> </ul> <p><em>BugTraceAI is built for authorized security testing only. Only test applications you have explicit written permission to test.</em></p> security opensource ai cybersecurity