AI Pentesting Agents: How They Work, Open Source vs Enterprise (2026)

Every agent runs the same loop: plan, act, observe, remember. The model reads the goal and what it knows so far, chooses an action such as a port scan, a request or an exploit, a tool runs it, and the output goes back to the model, which decides what to do next. The loop stops when the goal is reached, the budget runs out or a person stops it.

The model alone cannot do this. The scaffold around it supplies the tools, a sandbox to run them in, memory of what was tried, the scope it must stay inside and the format of the report. Research keeps finding that the scaffold matters as much as the model: AutoPT almost doubled task completion on the same model by constraining it with a state machine, and the ARTEMIS study saw general-purpose coding scaffolds fall behind most human testers on the same network where a purpose-built one came second.

The main designs you will meet:

• Assistant. The agent suggests the next step and a person runs it. The original PentestGPT design.
• Single autonomous agent. One model with many tools runs the whole loop.
• Multi-agent. A controller hands work to specialists for recon, exploitation or lateral movement, each with its own tools and context. PentAGI, Strix and VulnBot work this way.
• Tool bridge. An MCP server exposes security tools to any model, as HexStrike AI does. The intelligence and the safety rules then live wherever the model runs.
• White box. The agent reads the source code first and then attacks the running application, as Shannon does.

The best-known open-source projects in November 2026 are in the table below. A few things the stars on GitHub do not show:

• Licences differ. MIT and Apache-2.0 allow commercial use; AGPL-3.0 has obligations if you offer the tool as a service; CAI's own code is limited to non-commercial research and the project was archived in August 2026 in favour of a commercial successor.
• Open core is common. Strix and Shannon are free to run, with paid cloud or enterprise editions on top.
• Where the model runs is a setting, not a given. PentestGPT's autonomous mode drives a cloud coding agent; its legacy mode and PentAGI can use local models. With a cloud model, every banner, response and credential the agent sees is sent to a third party.
• Most are built for one kind of target. Strix and Shannon are web-application testers; PentestGPT and PentAGI lean towards networks and CTF-style machines. Few of them cover Active Directory, lateral movement and internal networks end to end.

Independent, blind evaluations are still rare. What exists:

• A live enterprise network. In the Stanford-led ARTEMIS study (ICLR 2026), ten professionals, six existing agents and the authors' framework tested a university network of about 8,000 hosts. ARTEMIS placed second, ahead of 9 of the 10 humans, with 9 valid vulnerabilities and 82% valid submissions; it produced more false positives than the humans and struggled with GUI tasks. More in AI pentesting vs human pentesters.
• Autonomous vs assisted. On AutoPenBench (33 tasks), a fully autonomous agent solved 21% and the same agent with human help 64%.
• CTF benchmarks. Cybench uses 40 professional CTF tasks. XBOW's 104 web challenges were widely quoted until XBOW's own repository declared them saturated as of mid-2026, with the vulnerabilities trained into the models.

Two limits apply to almost every number you will see. CTF tasks have a known goal, a flag, so they are not blind; and public tasks leak into training data. Treat a vendor's or a project's own benchmark score as marketing until someone else reproduces it on a network the agent has never seen.

• Scope enforcement

  An agent that improvises will find hosts you did not list. The platform, not the prompt, must refuse out-of-scope targets, including inside the scripts the agent writes.

• Approval gates and an emergency stop

  Decide which actions wait for a person, and make sure one button stops every agent at once and stays stopped after a restart. See human in the loop.

• Where the data goes

  Captured credentials and internal hostnames are sensitive. A local model on hardware you control keeps them inside; a cloud API does not.

• Evidence and audit trail

  Auditors want to know what was run, when, by whom and what came back, in a record nobody can edit afterwards.

• Reports and compliance mapping

  Raw agent transcripts are not a report a board or a regulator will read.

• Maintenance and support

  Tools, exploits and models change every month. Someone has to keep the stack working and answer when it breaks a system.

Open-source agents are excellent for research, training and labs. Running one against production is a decision to build and own all of the above. The OWASP Autonomous Penetration Testing Standard lists these controls as requirements and is a good checklist whichever way you go.

• Attackers use the same tools. Check Point reported in September 2025 that, within hours of HexStrike AI's release, criminal forums discussed using it against new Citrix NetScaler flaws and claimed exploitation time fell from days to minutes. Those are forum claims, not confirmed attacks, but the window between disclosure and exploitation keeps shrinking either way.
• The target can talk back. An agent reads everything the target returns, and a page, banner or file can carry instructions aimed at the model. Shannon's own documentation warns against running it on untrusted codebases for this reason. This is prompt injection turned against the tester.
• False findings. Agents report more false positives than skilled humans. Ask for proof: what was sent, what came back, what was reached after access. See exploit validation.
• Collateral damage. An agent that retries an exploit ten times or runs a brute-force tool without limits can lock accounts or crash services. Rate limits and approval for disruptive actions are not optional.

Agents do not remove the need for people. They are good at breadth and repetition: every host, every week, every new CVE. Humans are still better at business logic, social engineering and the judgement calls a regulator-led test such as DORA TLPT requires.

For a buyer, the useful split is by delivery: an open-source agent you run and maintain, a cloud service that runs agents against you, or a platform that runs autonomous penetration testing inside your own perimeter. The tools comparison covers the commercial platforms, and the evaluation guide gives a pilot plan to test any of them.

Is PentestGPT free? Yes, it is MIT-licensed. You pay for the model it uses: its autonomous mode drives Claude Code or Codex, so you need an account with those providers; the legacy assistant mode can also run on a local model.

Can I run an AI pentesting agent offline? Some support local models, PentAGI and PentestGPT's legacy mode among them. You then need a GPU large enough for a capable model, and accuracy depends on which model you can run.

Are AI pentesting agents legal to use? Using them is legal on systems you own or have written permission to test, the same as any pentest tool. Without authorisation it is a crime in most countries.

Which open-source agent is best? There is no independent ranking. Pick by target: Strix or Shannon for web applications, PentAGI or PentestGPT for networks and labs. Check the licence and whether the project is still maintained.

Do AI agents replace human pentesters? Not yet. On a live network the best research agent beat most humans on valid findings, but with more false positives and gaps on GUI work. The common model is agents for breadth and frequency, humans for depth and judgement.

How does Zero Hunt's agent work? Zero Hunt is an autonomous AI red team for networks and infrastructure that runs on an on-premise appliance with its own models, so no customer data leaves it. A controller coordinates ten specialist agents for recon, vulnerability analysis, exploitation, web, credentials, post-exploitation, pivoting, ATT&CK coverage, source analysis and reporting. Five autonomy levels decide which actions wait for an operator, scope is validated on tool calls and in generated scripts, the emergency stop persists across restarts, and every attempt is an Ed25519-signed, hash-chained record. Campaigns run once or on a daily, weekly, monthly or custom schedule, in black-box or gray-box mode. Zero Hunt publishes no benchmark numbers yet; its evaluation methodology is in preparation.