Autonomous Pentesting Agent

Autonomous web pentesting agent for local HTTP benchmarks isolated with Docker. The system combines a Planner, a tool-using Worker, and deterministic validation through exact flag submission or HTTP-backed vulnerability reports.

Key Features

• Targets run inside isolated Docker containers.
• Agent constrained to the authorized HTTP scope.
• Strict validation: flags must be observed and submitted exactly.
• Supports Demo Notes and XBEN benchmarks.
• Local JSON reports generated in results/.

Installation

Requirements: Python 3.11-3.14 and Docker.

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.lock
pip install --no-deps -e .
docker build -t autopentest-worker:local -f docker/worker.Dockerfile docker
docker build -t autopentest-target:local -f docker/target.Dockerfile docker

Usage

export OPENAI_API_KEY='your-key'
autopentest run
autopentest sandbox
autopentest run --evaluation findings

Run against an XBEN challenge:

autopentest run --benchmark-kind xben --benchmark /path/to/XBEN-058-24

Default model: gpt-4.1-mini, configurable with --model.

Evaluation

To limit API cost, the agent was evaluated on 10 randomly selected runnable XBEN challenges. With strict validation requiring the exact flag to be observed and submitted, it solves 8/10 challenges, achieving an 80.0% success rate.

Structure

src/autopentest/
├── cli.py          # CLI commands
├── agents.py       # Planner and Worker
├── core/           # Contracts, budgets, and evaluation
├── benchmarks/     # Benchmark loaders and target profiles
├── execution/      # Orchestration and reports
└── runtime/        # Docker sandbox

Tests

pytest -q
ruff check src tests docker
ruff format --check src tests docker