# I built an autonomous multi-agent AI pentester — and why it's not another GPT wrapper > Source: > Published: 2026-08-27 02:52:12+00:00 Most "AI pentester" projects are a single LLM in a while-loop with a shell. You give it a target, it runs commands until it decides it found something. That's how you get **confident nonsense** — a model that writes a beautiful vulnerability report for a bug that doesn't exist. I wanted the opposite: an engine where a finding has to be *earned*. So I built [OIHK](https://github.com/Broskigx/Oihk-pentesting) — an autonomous, multi-agent AI penetration-testing engine. It's open source (MIT) and runs locally. OIHK is a **multi-agent engine**. A root planner delegates to specialist agents — recon, discovery, validation, reporting — that all share two things: Agents don't coordinate by vibes in a chat log. They claim explicit plan steps, attach real evidence, and update state through a revisioned store. The root can't close a run while critical work is still open. Here's the design decision the whole thing is built around: An LLM writing a convincing PoC string is nota finding. A finding requires a **real, successful, governed tool execution** *and* a **separate validation record**. Only a validation agent can turn evidence into a finding. If there's no execution record and no independent validation, it never becomes a finding — no matter how confident the model sounds. Offensive tools + autonomous agents is a scary combo if "be careful" is just a line in a prompt. In OIHK the guardrails are actual code: `example.com` doesn't authorize its subdomains or resolved IPs. Declared hosts are resolved once and DNS-pinned for the whole run.OIHK is provider-agnostic. Any OpenAI-compatible endpoint works (LM Studio by default), with per-role model routing and no hardcoded provider. You can run a strong reasoning model as the planner and a fast one for the specialists. This is my favorite part. OIHK doubles as an **evaluation environment**: it runs the *real* engine against 16 local, deliberately vulnerable scenarios and scores the model **programmatically** — never by asking a model to grade itself. There's a deterministic offline `mock` solver for CI and demos: ``` bash uv run oihk eval run-all --model mock ```