I spent a few weeks living inside LLM-driven pentest tools, building and breaking them and running them against a web app I was authorized to test. Twelve projects later, here's the map I wish I'd had on day one: which ones matter, how they differ under the hood, and when to reach for each.
This is a tooling survey, not a how-to attack guide. Everything below is about open-source projects and public documentation.
What "agentic pentest" even means now
A year ago "AI pentesting" mostly meant pasting output into a chat window. In 2026 the serious tools are agentic: an LLM reasons about a target, calls real tools (nmap, nuclei, sqlmap, a browser, a shell), reads the results, and decides what to do next, looping with little or no human in between.
That shift splits the field along one axis that matters more than any feature list: where the brain lives.
- Self-contained agents ship the reasoning loop and the tools. You give them a target and a model; they do the rest.
- Tool layers ship only the hands: a big arsenal exposed over a protocol (usually MCP). The brain is an external client you plug in.
- Platforms wrap an agent in a product: web UI, memory, multiple models per role, reporting.
Keep that axis in mind and the field stops looking like a pile of repos.
The three that matter
Strix: the batteries-included agent
Strix is an autonomous multi-agent pentester on the OpenAI Agents SDK. A root agent delegates to sub-agents (recon, injection, auth, and so on); every turn must end in a tool call, which keeps the reasoning honest. Findings are validated with working proof-of-concept before they reach the report, and everything runs in a sandbox.
Why it stands out: it's the smallest distance from "nothing" to "a running autonomous agent": pip, a sandbox, a model, go. Provider routing is through LiteLLM, so OpenAI, Anthropic, Google, Bedrock, or a local model all work. It has a CI mode (headless, non-zero exit on findings) and can itself act as an MCP server.
The catch: the arsenal is smaller than a dedicated tool layer, and quality tracks the model hard. Weak local models fall apart on tool-calling discipline (more on that below).
HexStrike AI: the arsenal with no brain
HexStrike AI is the opposite design: a server that wraps 150+ classic security tools as MCP functions, plus a REST API. It does not think on its own. The reasoning comes from whatever MCP client you attach: Claude Code, Claude Desktop, Cursor, or your own loop.
Why it stands out: it's the widest ready-made toolset I've seen, and the clean separation ("brain separate from hands") means you can swap models freely and even drive it from your own pipeline over REST.
The catch: without a smart client it's just a tool wrapper, quality equals the external LLM, and there's no built-in finding validation or reporting. It's also dual-use with a reputation to match, so operational hygiene and isolation are on you.
PentAGI: the platform
PentAGI is the most product-like of the three: a web UI, Automation and Assistant (human-in-the-loop) modes, Postgres + pgvector memory, an optional Neo4j knowledge graph, per-agent model choice, and REST + GraphQL. A coordinator analyzes the target and spawns specialist agents.
Why it stands out: long-running engagements with memory, observability, and human oversight; you can assign a cheap model to grunt roles and a strong one to hard roles.
The catch: it's the heaviest to stand up (Docker Compose + Postgres, optionally Neo4j and monitoring), and it has fewer tools than HexStrike.
The comparison, at a glance
Snapshot as of 2026-10 (stars and last-push dates move; treat as a moment in time).
| Project | Type | Brain lives… | Notable | Setup cost |
|---|---|---|---|---|
| Strix | autonomous multi-agent | inside | PoC-validated findings, CI mode, LiteLLM routing | low |
| HexStrike AI | MCP tool layer | external client | 150+ tools, REST over MCP | medium |
| PentAGI | platform + agents | inside, per-role | UI, memory, Neo4j, human-in-the-loop | high |
The rest of the field, briefly
The long tail is worth knowing:
- Shannon is white-box: it reads the target's source to map attack vectors, then proves them with real exploits. It finds classes black-box testing misses. Note the AGPL-3.0 license if you're commercial.
- RedAmon is a self-hosted pipeline that doesn't stop at finding: recon → exploit → triage → code-fix → pull request, with a Neo4j attack graph.
- PentestGPT is the academic reference assistant; its agentic mode drives Claude Code or Codex as the execution backend.
- AI-OPS and hackingBuddyGPT are built for mid-size / local models and for prototyping your own agent ideas, respectively.
Avoid building on archived offensive frameworks (e.g. CAI): unmaintained attack tooling rots as dependencies age. Reference the patterns, don't run the code.
Pick by what you actually need
| If you need… | Reach for |
|---|---|
| An autonomous agent working in minutes | Strix |
| The widest tool arsenal under your own model | HexStrike AI |
| A standing platform with UI, memory, human oversight | PentAGI |
| To find bugs from source code and prove them | Shannon |
| Offense → defense with an auto-fix PR | RedAmon |
| To run on local / mid-size open models | AI-OPS, hackingBuddyGPT |
Where the LLM fits, and the wall nobody mentions
Across all of these, the bottleneck isn't security knowledge. It's tool-calling discipline: can the model reliably emit a valid tool call, read the result, and decide the next step, turn after turn, without drifting into prose?
Strong models clear that wall easily, which is why every one of these tools feels dramatically more stable on a frontier model than on a small local one. But "small local model" isn't a dead end. The shape of the toolset matters as much as the model. That's its own article (coming next in this series), and the result surprised me.
Takeaway
If you're starting today: Strix + a strong model is the shortest path to a working autonomous agent. Keep HexStrike in your back pocket as the arsenal to drive from your own client, and look at PentAGI when you need a standing platform rather than a one-off run. Everything else on the list is a specialist: know it exists, reach for it when the job fits.
This was the quick map. Tomorrow I'll publish the full field guide: the complete comparison table, deep profiles of all twelve projects, quick-start commands for the top three, and the diagrams that make the taxonomy click. Follow if you want it in your feed. (Link goes here once it's live.)
And later in the series: what happened when I pitted a local "cyber" model against a frontier model as the brain for the same tool arsenal.
Only ever run these against systems you're authorized to test.
Top comments (0)