Part 3 of a 3-part series on open-source security tooling. Part 1 covered AppSec tooling in Go, part 2 Firebase recon. This one is about AI agents.
Every week, a new headline claims AI agents will replace penetration testers by the end of the year.
As a security engineer who builds both detection engines and AI-assisted workflows, I want to cut through the noise and look at the real engineering behind autonomous offensive security agents.
Two open-source projects show where things are heading:
- PentAGI (by vxcontrol), https://github.com/vxcontrol/pentagi: a self-hosted, multi-agent system that plans and runs penetration testing tasks on its own.
- CommunityTools (by Transilience AI), https://github.com/transilienceai/communitytools: open-source Claude Code skills, agents and slash commands for AI-assisted pentesting, bug bounty hunting and code analysis.
Both show we're in the middle of a big transition. But if you want to use tools like these on real client engagements, there's an elephant in the room that most AI enthusiasts ignore.
1. The confidentiality trap: why local models matter
If you're testing a bank, a healthcare provider or an enterprise SaaS, you usually can't stream raw traffic, proprietary source code or live findings to an external cloud API. Doing so can breach your NDA and the client's data-handling rules.
That's why PentAGI's architecture matters. It's self-hosted and supports local models through Ollama (or vLLM), so it can run inside a closed network:
- No target data sent to a third-party model provider
- Everything running on your own infrastructure
- Targets, credentials and findings staying inside the engagement
2. Where AI agents actually shine
Used well, an agent doesn't replace the researcher. It turns one engineer into a small triage team:
- Digesting JavaScript jungles: reading huge minified bundles to reconstruct hidden API endpoints and GraphQL queries.
- Recon synthesis: correlating output from
subfinder,nmapandhttpxinto one attack-surface map. - Report writing: turning raw curl commands and terminal output into clear vulnerability reports with severity ratings and remediation steps.
3. Where autonomous agents fall flat
Security isn't just pattern recognition. Agents still struggle with:
- Deep business logic: multi-tenant billing rules, multi-step account takeovers.
- State and timing: race conditions and subtle session transitions across microservices.
- Hallucinated impact: calling something a "critical RCE" because an error message echoed user input.
The verdict: deterministic core, AI copilot
The future of offensive security isn't handing an LLM an open terminal and hoping it finds a zero-day. It belongs to engineers who build hybrid workflows:
- Fast, deterministic Go and Python tools to discover anomalies and gather facts.
- Local, privacy-preserving models to analyse context and draft reports.
- Human judgment to verify impact and find the logic flaws.
Are you experimenting with local LLMs (like Ollama) in your security or development workflow? What's been your biggest win or roadblock?
