The Top Open-Source AI Pentesting Tools in 2026, and What Each One Leaves You to Build

Fewer than five open-source offensive security agents existed before GPT-4 shipped. By March 2026 Hadrian’s census counted roughly seventy. The good ones are not thin LLM wrappers. They drive nmap, Burp and sqlmap, read the output, reason about what it implies, and choose the next move. That is closer to how a tester works than to how a scanner runs.

So the category is real, and this guide takes it seriously. What it does not do is rank the tools against each other, because they are not doing the same job. PentestGPT advises a human. BugTrace-AI deliberately refuses to exploit anything. HexStrike AI is plumbing. Comparing them on a single axis produces a leaderboard that helps nobody.

The more useful question is which part of a penetration test each one actually covers, and which parts it hands back to you.

How to read this list: the four jobs a model does not do

A frontier model reasons. It cannot act. Four jobs sit between model capability and a result an enterprise can act on, and none of them is a reasoning problem, so none is solved by pointing the tool at a better model.

• Execution. Delivering a payload to a live target and determining whether exploitation actually succeeded.
• State. Holding coherence across the 30 to 100 or more steps a real engagement runs, so the agent does not forget a credential it harvested forty steps ago.
• Validation. Proving each finding against the live system, rather than reporting a confident hypothesis.
• Safety and governance. Scope enforcement, blast-radius limits, an audit record, and a named owner when something goes wrong.

Every tool below solves at least one of these well. None solves all four. Where each one stops is the most useful thing about it.

Class 1: Reasoning assistants

These do not touch your targets. They think alongside a human who does.

PentestGPT

The project that started the category, and still the clearest teacher of agentic methodology. It runs three modules that each hold their own model session: a reasoning module maintaining a task tree of what has been tested and what remains, a generation module that turns the chosen next step into an actual command, and a parsing module that cleans noisy tool output back into something the reasoning module can use. Splitting the sessions is what keeps context from collapsing on a long engagement.

The academic backing is the strongest here. The USENIX Security 2024 paper reported a 228.6 percent improvement in task completion over a GPT-3.5 baseline and took a Distinguished Artifact Award. Python, MIT licensed, covering web, crypto, reversing, forensics and binary exploitation.

Where it stops: it advises, it does not act. Execution is yours, validation is yours, and there is no scope enforcement because it never sends anything. Provider configuration is reportedly finicky.

Best for: a skilled tester who wants faster note-keeping and a second opinion on sequencing, and anyone learning how agentic reasoning is structured.

Class 2: Autonomous multi-agent systems

These run the engagement themselves. This is the class most people mean by agentic pentesting.

PentAGI

The most complete self-hostable harness in the open-source world. A central coordinator delegates to four named sub-agents: Searcher for OSINT, Coder for scripts and payloads, Installer for dependencies and environment setup, and Pentester for offensive operations. Everything runs inside an isolated Docker environment with its own browser and search, so the agent can pull live CVE data mid-run instead of working from stale training data. It ships more than twenty built-in tools and uses PostgreSQL with pgvector for semantic long-term memory, which is a genuine answer to the state problem. Go backend, React frontend, model-agnostic, MIT licensed.

Where it stops: setup takes a day and the documentation is thin. Token cost climbs steeply with chain depth. Critically, Docker isolation is not scope enforcement. Nothing checks a proposed action against an authorised asset list before dispatch, so pointing it at production is a decision you make with no safety net underneath.

Best for: a team that wants a full autonomous harness it controls end to end, in a lab or staging environment.

VulnBot

The academic framework several newer tools build on. It simulates a human pentest team across five modules (Planner, Memory Retriever, Generator, Executor, Summariser) in a tri-phase design of reconnaissance, scanning and exploitation. Its best idea is the Penetration Task Graph, a directed acyclic graph where nodes are tasks and edges are dependencies, so independent branches run in parallel and the plan adapts as findings arrive. It runs on open-source models rather than requiring a frontier API, and offers automatic, semi-automatic and human-involved modes. Published results (arXiv 2501.13411): 69.05 percent subtask completion and 30.3 percent overall completion on AutoPenBench.

Where it stops: that 30.3 percent overall figure is the honest headline. It is Kali-based with a real configuration step, and full autonomy against messy production targets remains out of reach.

Best for: teams that want a self-hosted autonomous framework running open weights and do not mind the setup.

xOffense

A refined fork of VulnBot, and the most interesting economic bet in the category. Rather than calling a frontier API at every step, it fine-tunes a mid-scale open-weight model (Qwen3-32B) on chain-of-thought pentest data and runs it inside a multi-agent setup with specialised recon, scanning and exploitation roles. Published results (arXiv 2509.13021) report 79.17 percent sub-task completion on AutoPenBench, ahead of both VulnBot and PentestGPT running on larger models.

That result matters beyond this tool. It is direct evidence that domain adaptation and structure beat raw model size, which is the harness argument made by someone with no commercial reason to make it.

Where it stops: self-hosting a 32B model means owning GPUs and the operations to keep them fed. Sub-task completion is also not end-to-end completion, and the two get conflated constantly.

Best for: teams exploring domain-adapted local models instead of recurring cloud API bills.

PentestAgent

An academic multi-agent framework (AsiaCCS 2025) built on retrieval-augmented role collaboration. Four agents, Reconnaissance, Search, Planning and Execution, split the work across intelligence gathering, vulnerability analysis and exploitation. Injecting pentesting knowledge at decision time through RAG makes next-step selection noticeably more disciplined than an ungrounded single agent.

Where it stops: research-grade. Expect to read the paper and do the setup work.

Best for: researchers studying how grounding affects agent decision quality.

Class 3: Proof-first agents

These exist because a finding without proof is a triage ticket, not a vulnerability.

Strix

Deploys collaborating agents that run your application dynamically, find runtime flaws static tools miss, and confirm them by generating a functional proof-of-concept exploit. That confirmation step is the entire proposition: it removes the false-positive noise that makes scanner output tedious. A developer-first CLI drops it into CI/CD, where it can block a vulnerability before it ships and attach a fix suggestion. Apache 2.0 licensed. In one published test it confirmed a blind SQL injection with timing-based proof at CVSS 10.0 and mapped over forty endpoints.

Where it stops: an agent that autonomously exploits and executes code needs scope limits and approval gates before it goes anywhere near production, and those are not in the box.

Best for: dev and security teams that want verified, reproducible findings rather than a longer alert list.

Shannon (Keygraph)

A white-box agent pairing source code analysis with browser automation and CLI tooling, which lets it reach bugs that only surface when you can see the code, like a taint flow into a dangerous sink or a missing authorisation check. It reports 96.15 percent, 100 of 104 exploits, on a cleaned hint-free white-box variant of the XBOW benchmark. Keygraph is upfront that this is not comparable to black-box numbers on the original benchmark, which is a level of honesty worth crediting.

Where it stops: narrow focus. It concentrates on the headline OWASP classes and passes over business logic and configuration oddities. White-box also means you need source access, which rules out most third-party and vendor-supplied applications in an enterprise estate.

Best for: source-available targets where you want exploited, proven depth that a black-box agent structurally cannot reach.

Class 4: Orchestration layers

Not agents. Plumbing that lets an agent reach a toolset.

HexStrike AI

An MCP server that lets a model client autonomously drive more than 150 security tools through a dozen or so coordinated agents, exposing recon, web, password and binary analysis behind one standard interface. Built on FastMCP in Python, with optional Docker deployment. It is the fastest route from “I have an LLM client” to “my LLM can run a full offensive toolset.”

Where it stops: it is glue, not judgment. It does not validate findings or filter false positives. It also carries the clearest dual-use record in this list. Within hours of its v6.0 release, Check Point observed threat actors on underground forums discussing its use against freshly disclosed Citrix NetScaler flaws, with claims of compressing exploit development to under ten minutes. Hardened community forks have since added scope validation, blast-radius tiers and a per-session kill switch, which tells you those controls were missing and that the community noticed.

Best for: teams wiring an existing AI client into a broad toolset, in an isolated environment.

CAI (Cybersecurity AI Framework)

A build-your-own-agent kit and the most flexible option here. It connects models to the tools you already run and lets you assemble custom agents for web, cloud, network or malware analysis, so you are not constrained by someone else’s definition of a pentest. MIT licensed, largely Python, with support for hundreds of model backends including local models through Ollama. That last point matters more than it sounds: CAI is one of the few options you can run genuinely air-gapped, which is decisive for classified or data-residency-constrained work.

Where it stops: it is a framework, not a product. You do the assembly, and reviewers report loop-tuning work and degraded behaviour on small local models.

Best for: teams that want to design their own red team agents and have the engineering capacity to do it.

Class 5: Discovery without exploitation

BugTrace-AI

Analyses URLs, JavaScript files and headers to flag patterns that look like trouble, and then deliberately stops. It hands you a hunch with an explanation and usually a sample payload, but it does not fire. Multiple analysis personas cross-check each other, which keeps the report from filling with five versions of the same finding. Docker install plus an API key.

Where it stops: the proof is on you. It says where to look, you confirm whether anything is there.

Best for: low-noise discovery against sensitive or near-production targets where firing exploits is not acceptable.

The supporting cast, and an important distinction

A large share of repositories marketed as agentic pentesting are an agent loop deciding which of these to run and reading the output back: Nuclei for template-driven scanning at scale, Katana for crawling and endpoint discovery, AutoRecon for service enumeration, sqlmap for injection, Metasploit for weaponisation, ZAP as a DAST proxy, Semgrep for static analysis, and Garak for red-teaming your own AI features.

Orchestrating those tools is genuinely more capable than running a scanner. It is not a harness. The difference is that orchestration decides what to run, while a harness decides what is allowed to run, holds what happened, proves what worked, and can account for all of it afterwards.

Also worth bookmarking: CHECKMATE, which has the model write a formal planning problem and hands it to a classical planner, reportedly beating a native agent by more than twenty percent on success rate while running faster and cheaper. And HPTSA, the hierarchical planner-and-sub-agent design behind the roughly fourfold multi-agent advantage the research literature keeps finding. Both make the same point in miniature: structure beats model size.

Read the benchmark numbers carefully

This category has a measurement problem, and it cuts against vendors as much as against open source.

When you see a claim that an agent exploits 87 percent of vulnerabilities, ask what the model was handed. That figure typically comes from providing the advisory describing the vulnerability. Remove it and the same models solve roughly 13 percent of real CVEs, and close to nothing on genuinely hard targets. One variable, a sixfold swing.

Sub-task completion is not end-to-end completion, and the two are used interchangeably in marketing. VulnBot’s 69.05 percent sub-task rate sits alongside 30.3 percent overall completion in the same paper.

The most honest evidence available is the ARTEMIS study (arXiv 2512.09882, December 2025, Stanford, CMU and Gray Swan AI), which ran agents and ten OSCP-certified humans against the same live 8,000-host network. The researchers’ purpose-built agent produced 9 valid findings, beating 9 of the 10 humans at roughly $18 an hour against $60-plus for a person. It still lost to the top human, 9 findings to 13. It lost on false positives and on the messy work that does not reduce to clean enumeration. That was a purpose-built agent. An off-the-shelf one does worse.

The pattern across all of it is consistent. These tools are strong at the front of the attack chain, on recon and enumeration, fade through the middle, and are weakest at the back, where creative chaining and business logic live. That is precisely the part that separates a pentest from a scan.

The gap every tool on this list shares

Read the ten “where it stops” notes together and the same four items appear.

No scope enforcement below the model. Docker isolation contains the agent’s own process. It does nothing about the agent deciding a related subdomain is in scope after a redirect.

No blast-radius control. No token-bucket rate limiting per host, so brute-force behaviour locks production accounts. No default block on modify, update and delete operations. Community forks bolting these onto HexStrike is the exception that proves the rule.

No tamper-evident audit record. Console logs and optional tracing exist. Nothing produces a retained, timestamped record of every decision, payload and response that survives an auditor’s question six months later, which is what DORA and PCI DSS 4.0 increasingly expect.

No accountability. When an agent tests out of scope or writes to a live database, someone signs the incident report. With a cloned framework, it is the engineer who cloned it.

None of these are oversights. Building governance infrastructure is not what a research project or a community tool is for. It simply becomes the deploying team’s job, and that is the real price of the free licence.

Where FireCompass fits

FireCompass is the harness argument taken to its conclusion. Rather than a single model behind a wrapper, it routes each task class to the model that performs best for it, alongside purpose-built small language models trained in-house for high-volume work, driven by its own orchestration engine across seven specialised agents: surface mapping, reconnaissance, vulnerability assessment, authentication and credentials, business logic, chain and lateral movement, and evidence collection.

Those agents run over a persistent state machine holding a graph of assets, relationships, authentication surfaces, tested paths and accumulated credentials, which survives any individual agent or model context reset. Every candidate finding passes a four-stage validation pipeline, and findings that fail to reproduce are discarded rather than reported as low-confidence noise. That is the mechanism behind a below-2-percent false-positive rate, and it is validation-layer discipline rather than model accuracy.

Safety sits as a mandatory enforcement layer between orchestration and the execution runtime, on the principle that a non-deterministic model is governed by deterministic rule-based systems and never by another model. Scope is checked before every dispatch; read and create are permitted in scope while modify, update and delete are blocked by default; request velocity is capped per host; an operator kill switch propagates to every active agent; and credentials carry environment tags so UAT credentials cannot reach production. Underneath, an append-only audit log with cryptographic timestamps supports DORA, PCI DSS 4.0, SOC 2 Type II and ISO 27001.

Tested the same way this article asks you to test everything else: three months against live production targets in authorised public bug bounty programmes, reaching No. 3 on HackerOne’s US country board, No. 2 for Highest Critical Reputation, No. 1 in OWASP A01 Broken Access Control and No. 1 in Up and Comers, on a $5,000 monthly budget covering tokens, cloud and human oversight.

HackerOne is a trademark of HackerOne Inc. HackerOne has not sponsored, verified, approved or endorsed this content. HackerOne rankings are dynamic and recalculated daily.

Side by side

Open-source column reflects the significant public projects as of August 2026. Individual projects vary.

How to choose

Clone one of these if you have offensive engineering capacity, a research mandate, and a narrow scope. Start with PentestGPT to learn the methodology, PentAGI if you want a complete self-hosted harness, CAI if you need to build something specific or run air-gapped. Run them against lab and staging first, cap the step count, and put a human on anything rated high or critical.

Do not clone one if the goal is a programme covering thousands of applications with an evidence trail an auditor will accept. At that scale you are not adopting a tool. You are staffing a product team to build scope enforcement, audit infrastructure, validation, reporting and remediation routing, and then to maintain all of it while the model layer underneath changes every few months.

The models are becoming commodity, and quickly. Everyone in this category, open source and commercial alike, reaches the same reasoning ceiling within a release cycle of everyone else. What differs is everything around the model, and that is engineering work that compounds and does not demo well.