PentesterFlow Launches Open-Source AI CLI Tool for Penetration Testers and Bug Bounty Hunters
PentesterFlow is a new open-source, human-in-the-loop AI command-line tool built for penetration testers and bug bounty hunters. It automates the entire workflow from information gathering to report generation without removing analyst control.
Most agentic AI security tools suffer from hallucinated findings, poor context retention, and weak tool integration. PentesterFlow tackles these problems with built-in pentesting skills, evidence-based vulnerability confirmation, and continuous local learning capabilities.
The tool connects to local or hosted large language models such as Ollama, LM Studio, Kimi, Groq, Gemini, DeepSeek, and OpenRouter. It plans actions against defined targets, runs real security testing tools, and always requests explicit analyst approval before executing sensitive commands.
Core Capabilities
PentesterFlow covers the full penetration testing lifecycle: scoping, reconnaissance, enumeration, vulnerability validation, coverage tracking, reporting, and ongoing learning.
- Model backends: Ollama, LM Studio, Kimi, Groq, Gemini, DeepSeek, OpenRouter and OpenAI-compatible APIs
- Built-in skills: Recon, Web vulnerabilities, SSRF, SSTI, JWT, GraphQL, race conditions, subdomain takeover, Supabase, deserialization
- Toolset: Shell/Bash, HTTP, Burp Suite bridge, browser capture, MCP support, file operations, grep/glob
- Report output: Confirmed findings with PoCs, impact analysis, remediation advice, and ready-to-use curl commands
In a live demonstration, the tool loaded a web vulnerability skill module, sent HTTP requests against an order API, and automatically confirmed a high-severity IDOR vulnerability, writing the evidence-backed finding directly to a Markdown file.
Security and Integration
PentesterFlow enforces permission-based tool calls, blocks dangerous shell command patterns, and redacts credentials during compression and snapshot operations. It also offers a YOLO mode that auto-approves all actions inside isolated lab environments.
The tool integrates directly with Burp Suite through a companion bridge, allowing testers to import captured traffic into the CLI and export confirmed findings back as Burp issues.
Installation and Usage
Installation uses a simple shell script on macOS/Linux or PowerShell on Windows to fetch the latest standalone binary and verify its SHA-256 checksum. Users can pin specific versions, select local models such as Ollama’s qwen2.5-coder, or connect to hosted providers, then set targets with the /target command and issue natural-language instructions.
Analysts working on sensitive targets are reminded that PentesterFlow is intended solely for authorized security testing, as approved commands can execute real shell operations and send live HTTP requests.
Industry Positioning
Alongside projects such as PentAGI and PentestGPT, PentesterFlow distinguishes itself through transparent, reproducible evidence chains and mandatory analyst approval, making it suitable for security teams cautious about fully autonomous penetration testing agents.
Related articles
Israeli Firm Reveals First Known AI-Led Breach of Taiwanese Government Systems
An Israeli cybersecurity company named Dream discovered an open 160 MB archive containing 1,395 files that documented a fully autonomous AI operation against Asian government infrastructure later identified as Taiwan. Between July 1 and July 4 2026 the system ran 12 sequential waves using up to eight sub-agents simultaneously, each handling reconnaissance, exploitation, lateral movement and persistence without further human input after initial setup. The agents mapped 21 interconnected government systems, exploited unauthenticated debug endpoints and single-sign-on weaknesses, and ultimately compromised 85 employee accounts while exfiltrating more than 2,500 personnel records. The framework relied exclusively on two publicly available open-source AI assistants, Hermes and OpenClaw, and bypassed model safety filters by framing the task as an authorized penetration test. The same agents later expanded into government IT suppliers, the national email system, seven energy companies and the nuclear safety agency while performing internal validation that rejected seven false-positive findings. No zero-day exploits were used; all successful access paths involved exposed endpoints, disabled signature checks and missing authentication controls.
GitHub Copilot Traffic Analysis via MITM Proxy Exposes Prompt Context Handling and Local SQLite Session Storage
A detailed reverse-engineering study placed GitHub Copilot behind an mitmproxy instance to inspect all network requests made by Visual Studio Code. The analysis revealed that Copilot performs OAuth token exchange, model availability checks, and intent classification before any user input occurs. Prompts sent to the model include context from recently edited files, even when inline suggestions are disabled for sensitive extensions such as .env. Copilot maintains a local SQLite database named session-store.db that records every user prompt, LLM response, repository, and branch worked on. The extension also exposes a session_store_sql tool allowing the model to run read-only SQL queries against this history using the Copilot Chronicle skill. These findings highlight how AI coding assistants manage context, authentication, and persistent local state.
Anthropic Rolls Out Invisible Statistical Watermarks for Claude Models to Comply with EU AI Act
Anthropic has embedded invisible statistical watermarks into all outputs from its Claude models starting August 2, 2026, to meet Article 50 of the EU AI Act. The two-layer system applies a token-level bias using a secret key for text and C2PA metadata for images and files. Open-source projects appeared within 24 hours promising to strip the marks, yet none have demonstrated verifiable success against the statistical layer because Anthropic has not released a public detector. The technique, first described by Kirchenbauer et al. in 2023 and deployed by Google as SynthID, works by subtly biasing token selection toward “green” lists during generation. Editing, translation, or full paraphrasing rapidly degrades detectability, while short or rigidly formatted text such as code offers little room for the signal. The move affects every Claude deployment worldwide, not only EU users, to avoid maintaining dual model versions.
Guardrails Filter Tackles Complex LLM Streaming and Tool Call Challenges to Protect Sensitive Data
Developers at Cloud.ru built Guardrails Filter to mask personal data such as phone numbers, emails, passport details and names before they reach large language models. The system replaces detected values with consistent placeholders like <PHONE_1> and maintains a mapping table so original data can be restored after the model responds. Simple replacement proved insufficient because identical values must receive the same placeholder across an entire conversation history, and the model receives the full message array on every request. Streaming responses using SSE create additional difficulties since placeholders can be split across multiple chunks, requiring buffering of 10-15 characters and state tracking for reasoning, content and tool_calls. The team also had to handle JSON-inside-JSON arguments for tool calls, different field names across providers, and edge cases such as escaped newlines matching email patterns. Separate implementations were written for OpenAI Chat Completions and Anthropic Messages APIs, resulting in roughly 1,500 lines of streaming code and more than 4,000 lines of tests to ensure agent pipelines remain intact.