The purpose of this article is to provide a landscape of existing solutions in order to identify those that could fit into the practices of a professional pentester/cybersecurity auditor. The analysis covers their effectiveness in realistic environments, their cost, their degree of autonomy, their functional coverage, and the confidentiality issues associated with handling sensitive data.
Indeed, there is no longer any doubt today about the value of using AI to carry out penetration tests. The release of the latest frontier models such as Fable 5.1 or GPT Astra 6 confirms an underlying trend: the cyber-offensive capabilities of large language models (LLMs) are advancing rapidly. The security incident that occurred during an internal OpenAI evaluation on the ExploitGym benchmark provides a striking illustration of this.[1] A combination of models with reduced cyber refusal settings, including GPT-5.6 Sol and a more capable pre-release model, bypassed the network isolation of the evaluation environment. To do this, they exploited a zero-day vulnerability in the package registry proxy, then spread into OpenAI’s infrastructure. After gaining internet access, the models chained together several attack vectors against Hugging Face’s production infrastructure in order to access the ExploitGym benchmark solutions directly from the database.
Since the early work on PentestGPT, presented at USENIX Security, both the market offering and academic research have evolved considerably. This work showed that LLMs could bring real value to penetration testing, first as assistants capable of structuring an operator’s reasoning, then as the engines behind more autonomous systems.
The potential of generative AI grows when the model is embedded in an agentic solution capable of planning actions, calling tools, analyzing their results, and adapting its strategy. Publications describing multi-agent architectures are multiplying[2][3][4], as are open-source projects. At the same time, commercial players are establishing themselves in the market and attracting significant funding, as illustrated by Horizon3, which announced $250 million in funding in August 2026.[5]
What types of solutions exist on the market?
The selected scope covers agentic solutions that use one or more generative AI models to assist with or carry out a penetration test. It therefore excludes:
- The LLM models considered in isolation, such as Fable 5, GPT 5.6, or DeepSeek V4 Pro
- Solutions that select their actions using decision-making models that are not generative (e.g. DeepExploit)
- Solutions that automate penetration testing using deterministic methods (e.g. AutoPentestX)
Among all the solutions documented online, a large proportion are open-source solutions available on GitHub. Some of these projects are primarily academic prototypes aimed at advancing the state of the art. At the other end of the spectrum, a growing number of vendors offer platforms that promise to carry out penetration tests on demand or continuously, generally more integrated but also more opaque about their architecture.
Architecture
Several architectures coexist on the market, but the overall architecture of an agentic solution can be described by the diagram below (see this article for more details)
The table below lists the identified main families of architectures, without detailing how they work, for the sake of conciseness and readability:
|
Architecture |
Description |
Comment |
Examples |
|
Single agent |
A single agent follows a ReAct loop (Reason Then Act), which consists of asking the LLM what action to take next and then executing the corresponding tool |
Architecture of the pioneering solutions, whose main limitation is reduced effectiveness caused by exceeding the context window due to the large number of tokens produced during a penetration test |
PentestGPT, VulnHuntr, Metatron |
|
Orchestrator / executors |
One agent acts as a high-level orchestrator and delegates subtasks to execution agents |
Most solutions incorporate this architecture in one form or another, the orchestrator generally requires a frontier model capable of long-term reasoning, while the executors can rely on a cheaper model |
LuaN1ao, Deep Eye, Incalmo
|
|
Multi-agent with specialized roles |
Several agents, each with its own specialization, are deployed in parallel or in a pipeline fashion |
Specialized agents can be general purpose (reconnaissance, exploitation, development) or expert (agent specialized in database injection (SQLi), in Cross-Site Scripting (XSS), in reverse-engineering) |
PentAGI, Shannon, Strix |
|
Dynamic swarm |
A large number of agents interact in parallel in an organic, swarm-like manner |
Depending on the results, an agent can be activated to explore a particular lead or, conversely, deactivated if the lead does not pan out |
Pentest Swarm AI, Decepticon, Terra Security |
|
MCP-centered integration |
Tools are exposed to the agentic system as MCP servers |
Few solutions rely solely on this architecture, but many add MCP servers as an additional feature |
HexStrike AI, PentestMCP, AutoPentest-AI |
|
Claude Code native |
Agents are skill files ready to be integrated into Claude Code |
No middleware, but implies a strong dependency on the Claude environment |
Raptor, Transilience AI Community, Claude Bug Bounty |
These categories are not mutually exclusive. The same solution can, for example, combine an orchestrator, several specialized agents, and tools exposed via MCP.
Autonomy
The level of autonomy should be distinguished from technical capability. A solution can perform very well on a specific task while still requiring frequent human intervention. This landscape uses the following scale:
- Human-driven assistant: the solution is an assistant with cybersecurity expertise that a human can talk to and ask for advice, there is no direct execution of tools or interaction with the target (e.g. PentestGPT v0)
- Semi-autonomous: the solution is partly autonomous on certain tasks but requires relatively complex upfront configuration by a human and/or regularly needs human intervention to continue the penetration test (e.g. hackingBuddyGPT)
- Automated with human-in-the-loop: the solution carries out the large majority of the penetration test autonomously but keeps the human in the loop for the most critical actions or for confirmation (e.g. Decepticon)
- Fully automated end-to-end: the solution carries out the entire penetration test with minimal to no human intervention (e.g. Strix)
Capabilities covered
Penetration testing covers a wide range of different categories that are not evenly represented on the market.
Indeed, the offering today is most mature for web applications, APIs, and code review (SAST), and to a lesser extent for internal infrastructure penetration testing. Far fewer solutions, on the other hand, specifically target industrial penetration testing, product audits, and advanced reverse engineering. Claims related to Red Teaming should be analyzed with caution. A Red Team exercise is not just about finding vulnerabilities: it requires fine-grained mastery of stealth, rules of engagement, and operational risk. These constraints are harder to delegate to an autonomous agent than an exhaustive search for vulnerabilities on an isolated application.
In addition, many open-source and academic solutions are designed and evaluated in simplified Capture The Flag (CTF) environments. While solving these tasks demonstrates good cyber-offensive capability, CTFs often emulate a very simplified environment with a funnel-shaped exploitation process that differs greatly from the complexity of real-world environments.
Nonetheless, some solutions have demonstrated their potential by finding vulnerabilities in production projects. AISLE claims 380 attributed CVEs[6], of which 98 CVEs were confirmed by BugFlation[7]. The autonomous XBOW agent reached first place on the HackerOne leaderboard within a few months, and its vendor claims to have found more than 14,000 zero-days[8] in its clients’ applications. Among open-source solutions, MAPTA and VulnHuntr are worth mentioning, having respectively found 19 vulnerabilities[9] and 10 zero-days[10] (6 of which were registered as CVEs) in popular open-source projects.
Comparison criteria
To establish a consistent comparison, the following criteria were selected:
- The type, to distinguish fully open-source solutions, commercial solutions, and hybrid offerings whose code is open source but which offer a more powerful platform to deploy it
- The architecture, as mentioned above
- The degree of autonomy, to determine, depending on the need, the right balance between an assistant chatbot and a fully automated end-to-end penetration test
- The categories of tests covered:
- Web, API, and mobile applications
- Code analysis and configuration review
- Infrastructure and network
- Cloud and containers
- Industrial pentesting, product audits, and reverse engineering
- Red Team and social engineering
- The models supported by the solution
- The costs, on demand or per month for commercial solutions, and in token consumption for open-source solutions
- The popularity, measured by the number of stars on GitHub repositories
The question of which models are supported by agentic solutions is particularly relevant, since some solutions only work with specific models (typically those from OpenAI and Anthropic) or only deliver satisfactory results with proprietary frontier models.
Given the substantial cost of tokens for frontier models, it is worth asking whether these solutions can interface with local models or with less capable but cheaper models, such as DeepSeek or Kimi, and still perform just as well.
To give a sense of scale, a run consuming 4 million input tokens and 1 million output tokens would cost around $90 with Claude Fable 5, $45 with Claude Opus 4.7, and less than $3 with DeepSeek V4 Pro, based on public pricing observed in July 2026. This comparison remains indicative, since actual cost can vary depending on caching, tool calls, retries, and differences in tokenization.
What can these solutions concretely do?
Strengths
In general, agentic solutions are very effective at finding common and well-documented vulnerabilities (SQL injection, XSS, CVEs), but less effective at identifying zero-days or exploiting more specific vulnerabilities that require an understanding of complex business logic.
Their immediate value therefore lies less in replacing the auditor than in increasing their working capacity. When used under supervision, these solutions can:
- Speed up reconnaissance, enumeration, and mapping of the attack surface
- Explore more leads and generate more payload variants than an operator could in the same amount of time
- Document the steps taken and prepare a first draft of findings and recommendations
- Automate part of the retesting process to verify the reproducibility of a vulnerability and the effectiveness of a fix
- Free up the auditor’s time for complex decisions, business understanding, and high-value exploitation scenarios.
Points of attention
That said, not all solutions are necessarily ready yet to be integrated as-is into audit and penetration testing engagements.
Hallucinations remain a risk, particularly when the agent infers a vulnerability from a partial response or misinterprets a tool’s output. Validation mechanisms reduce false positives but do not eliminate them.
Staying within scope is a second challenge. An agent can send an excessive number of requests, follow a redirect to a third-party domain, use an unintended credential, or trigger a disruptive action. Safeguards therefore need to be technical, not just stated in the prompt.
Some vulnerabilities also require intuition, a deep understanding of the business and scope, and the ability to assess impact beyond a proof of concept. These dimensions remain difficult to automate and justify keeping an experienced operator involved in carrying out the penetration test.
Finally, data confidentiality and sovereignty are central concerns. A penetration test can expose source code, architecture details, credentials, test data, and unpatched vulnerabilities. Before using a remote model, it is therefore necessary to examine data retention practices, whether the data may be used for training, where processing takes place, the subcontractors involved, and the possibility of local deployment or deployment in a controlled environment.
Landscape
The market for agentic solutions applied to penetration testing is evolving at a particularly fast pace. Projects are multiplying, architectures are changing quickly, and new players are regularly emerging. The radar chart above shows the distribution of capabilities covered across a set of 69 solutions, but any overview is a snapshot in time that needs to be updated frequently.
Web, API, and mobile applications
This category groups together solutions designed to test web applications, APIs, and, less commonly, mobile applications. It represents the largest share of the market studied, covered by 81% of the solutions in this overview. Some solutions take a black-box approach starting from a URL, while others accept test accounts, API documentation, or full access to the source code.
The most convincing solutions do not simply run scanners: they build a model of the application, handle authentication, track session states, verify exploitability, and keep the evidence needed for the report.
Among the most promising solutions are Decepticon, Strix, Shannon, RedAmon, Transilience AI, DarkMoon, Pentest Swarm AI, Aikido, and XBOW.
Infrastructure and network
This category covers internal and external penetration testing, network mapping, privilege escalation, and Active Directory. This area is less mature than web applications but is still covered by 52% of the solutions studied. Several solutions still rely heavily on orchestrating existing tools, such as Nmap, BloodHound, or Metasploit, without always demonstrating a genuine ability to prioritize attack paths in a complex environment.
Interesting solutions in this category include Pentera, Cracken, PentAGI, NeuroSploit, and CyberStrike AI.
Code analysis and configuration review
This category groups together tools for code analysis, configuration review, and vulnerability research from a repository. It covers use cases close to SAST, dependency analysis, secret scanning, review of infrastructure-as-code configurations, and certain supply chain checks.
36% of the solutions studied cover this category, including notably AISLE, Claude Security, Shannon, RepoAudit, Metis, Raptor, and Clearwing.
Cloud and containers
Most solutions in this category, which accounts for 30% of the tools studied, are mainly geared toward discovering cloud-based endpoints and detecting misconfigurations in cloud systems and associated containers. Actually exploiting Kubernetes container escape vulnerabilities, for example, remains fairly rare.
Aikido, Hadrian, Claude Bug Bounty, PentestAgent, and RedAmon are among the most interesting solutions in this category.
Red Team and social engineering
Many tools present themselves as Red Team solutions, but this label covers very different realities. Only 13% of the solutions in this overview offer features characteristic of a Red Team: finding a compromise path relevant to an objective with a high level of control, stealth, and adaptability. A solution that massively enumerates services or runs payloads that are easily flagged by security tools can be useful for penetration testing while remaining unsuited to a Red Team operation.
Some tools also offer OSINT or social engineering features.
Among the most promising solutions are Decepticon, RedAmon, Drakben, Cracken, and Pentera.
Industrial pentesting, product audits, and reverse-engineering
Few solutions (7% of those studied) explicitly claim robust capabilities in industrial penetration testing, product audits, or reverse engineering. Some agents include disassembly or decompilation tools, but these features are often presented as add-ons for CTFs rather than as a complete audit capability.
The most relevant solutions in this category are Decepticon, DeepZero, Clearwing, and in particular, CAI, which documents use cases in industrial settings.[11]
Conclusion
The growing number of projects, their frequent updates, and the regular arrival of new players are contributing to rapid changes in this landscape. This analysis also runs into a lack of comparable data: the capabilities claimed by vendors and developers are not always demonstrated under realistic conditions, particularly for commercial solutions, which are by nature more opaque about their results.
An underlying trend does emerge, however: in the short term, these solutions will not replace professional auditors. They can, on the other hand, significantly boost auditors’ capabilities by automating repetitive tasks, improving the thoroughness of research, and speeding up certain phases of testing, from reconnaissance to vulnerability retesting. This shift could also lower the barrier to entry for certain offensive operations. Less experienced individuals (script kiddies) may be able to rely on agents to orchestrate tools and produce payloads that were previously reserved for more skilled operators.
At this stage, the best-performing solutions also remain costly, particularly when they rely heavily on leading proprietary models. Their adoption should therefore be evaluated in light of the productivity gains achieved, but also the confidentiality, sovereignty, and operational control constraints specific to each engagement.
Finally, securing the agents themselves is still an immature area of work: context manipulation, tool hijacking, secret exposure, or scope violations can turn an operational accelerator into a new attack surface.
The question, then, is no longer whether agentic AI will change penetration testing, but how fast and in what ways. The next step will be to test a selection of these solutions against scenarios representative of real security audit engagements, in order to measure their actual capabilities, costs, limitations, and the conditions needed for their integration into cybersecurity auditors’ practices.
[1] https://openai.com/index/hugging-face-incident-and-the-road-ahead/
[2] https://arxiv.org/abs/2408.11650
[3] https://arxiv.org/abs/2510.05605
[4] https://arxiv.org/abs/2509.13021
[6] https://aisle.com/cve-discoveries
[7] https://bugflation.com/systems/aisle/
[8] https://xbow.com/news/xbow-named-winner-in-fast-companys-2026-world-changing-ideas-awards
[9] https://arxiv.org/pdf/2508.20816
[10] https://github.com/protectai/vulnhuntr
[11] https://aliasrobotics.com/case-studies/case-study-cai-mqtt-broker.php
