{"slug": "i-built-an-autonomous-multi-agent-ai-pentester-and-why-it-s-not-another-gpt", "title": "I built an autonomous multi-agent AI pentester — and why it's not another GPT wrapper", "summary": "A developer has released OIHK, an open-source autonomous multi-agent AI penetration-testing engine that requires real tool execution and independent validation before reporting a finding, avoiding the 'confident nonsense' of single-LLM wrappers. The engine uses a root planner that delegates to specialist agents, with guardrails enforced in code, and includes a deterministic evaluation environment with 16 vulnerable scenarios.", "body_md": "Most \"AI pentester\" projects are a single LLM in a while-loop with a shell. You\n\ngive it a target, it runs commands until it decides it found something. That's\n\nhow you get **confident nonsense** — a model that writes a beautiful vulnerability\n\nreport for a bug that doesn't exist.\n\nI wanted the opposite: an engine where a finding has to be *earned*. So I built\n\n[OIHK](https://github.com/Broskigx/Oihk-pentesting) — an autonomous, multi-agent\n\nAI penetration-testing engine. It's open source (MIT) and runs locally.\n\nOIHK is a **multi-agent engine**. A root planner delegates to specialist agents —\n\nrecon, discovery, validation, reporting — that all share two things:\n\nAgents don't coordinate by vibes in a chat log. They claim explicit plan steps,\n\nattach real evidence, and update state through a revisioned store. The root can't\n\nclose a run while critical work is still open.\n\nHere's the design decision the whole thing is built around:\n\nAn LLM writing a convincing PoC string is\n\nnota finding.\n\nA finding requires a **real, successful, governed tool execution** *and* a\n\n**separate validation record**. Only a validation agent can turn evidence into a\n\nfinding. If there's no execution record and no independent validation, it never\n\nbecomes a finding — no matter how confident the model sounds.\n\nOffensive tools + autonomous agents is a scary combo if \"be careful\" is just a\n\nline in a prompt. In OIHK the guardrails are actual code:\n\n`example.com`\n\ndoesn't authorize its subdomains or\nresolved IPs. Declared hosts are resolved once and DNS-pinned for the whole run.OIHK is provider-agnostic. Any OpenAI-compatible endpoint works (LM Studio by\n\ndefault), with per-role model routing and no hardcoded provider. You can run a\n\nstrong reasoning model as the planner and a fast one for the specialists.\n\nThis is my favorite part. OIHK doubles as an **evaluation environment**: it runs\n\nthe *real* engine against 16 local, deliberately vulnerable scenarios and scores\n\nthe model **programmatically** — never by asking a model to grade itself.\n\nThere's a deterministic offline `mock`\n\nsolver for CI and demos:\n\n```\nbash\nuv run oihk eval run-all --model mock\n```\n\n", "url": "https://wpnews.pro/news/i-built-an-autonomous-multi-agent-ai-pentester-and-why-it-s-not-another-gpt", "canonical_source": "https://dev.to/broskigx/i-built-an-autonomous-multi-agent-ai-pentester-and-why-its-not-another-gpt-wrapper-1l09", "published_at": "2026-08-27 02:52:12+00:00", "updated_at": "2026-08-27 03:18:08.970265+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-agents", "ai-tools", "ai-safety", "developer-tools"], "entities": ["OIHK", "Broskigx", "LM Studio"], "alternates": {"html": "https://wpnews.pro/news/i-built-an-autonomous-multi-agent-ai-pentester-and-why-it-s-not-another-gpt", "markdown": "https://wpnews.pro/news/i-built-an-autonomous-multi-agent-ai-pentester-and-why-it-s-not-another-gpt.md", "text": "https://wpnews.pro/news/i-built-an-autonomous-multi-agent-ai-pentester-and-why-it-s-not-another-gpt.txt", "jsonld": "https://wpnews.pro/news/i-built-an-autonomous-multi-agent-ai-pentester-and-why-it-s-not-another-gpt.jsonld"}}