PentesterFlow Launches Open-Source AI CLI Tool for Penetration Testers and Bug Bounty Hunters
PentesterFlow is a new open-source, human-in-the-loop AI command-line tool built for penetration testers and bug bounty hunters. It automates the entire workflow from information gathering to report generation without removing analyst control.
Most agentic AI security tools suffer from hallucinated findings, poor context retention, and weak tool integration. PentesterFlow tackles these problems with built-in pentesting skills, evidence-based vulnerability confirmation, and continuous local learning capabilities.
The tool connects to local or hosted large language models such as Ollama, LM Studio, Kimi, Groq, Gemini, DeepSeek, and OpenRouter. It plans actions against defined targets, runs real security testing tools, and always requests explicit analyst approval before executing sensitive commands.
Core Capabilities
PentesterFlow covers the full penetration testing lifecycle: scoping, reconnaissance, enumeration, vulnerability validation, coverage tracking, reporting, and ongoing learning.
- Model backends: Ollama, LM Studio, Kimi, Groq, Gemini, DeepSeek, OpenRouter and OpenAI-compatible APIs
- Built-in skills: Recon, Web vulnerabilities, SSRF, SSTI, JWT, GraphQL, race conditions, subdomain takeover, Supabase, deserialization
- Toolset: Shell/Bash, HTTP, Burp Suite bridge, browser capture, MCP support, file operations, grep/glob
- Report output: Confirmed findings with PoCs, impact analysis, remediation advice, and ready-to-use curl commands
In a live demonstration, the tool loaded a web vulnerability skill module, sent HTTP requests against an order API, and automatically confirmed a high-severity IDOR vulnerability, writing the evidence-backed finding directly to a Markdown file.
Security and Integration
PentesterFlow enforces permission-based tool calls, blocks dangerous shell command patterns, and redacts credentials during compression and snapshot operations. It also offers a YOLO mode that auto-approves all actions inside isolated lab environments.
The tool integrates directly with Burp Suite through a companion bridge, allowing testers to import captured traffic into the CLI and export confirmed findings back as Burp issues.
Installation and Usage
Installation uses a simple shell script on macOS/Linux or PowerShell on Windows to fetch the latest standalone binary and verify its SHA-256 checksum. Users can pin specific versions, select local models such as Ollama’s qwen2.5-coder, or connect to hosted providers, then set targets with the /target command and issue natural-language instructions.
Analysts working on sensitive targets are reminded that PentesterFlow is intended solely for authorized security testing, as approved commands can execute real shell operations and send live HTTP requests.
Industry Positioning
Alongside projects such as PentAGI and PentestGPT, PentesterFlow distinguishes itself through transparent, reproducible evidence chains and mandatory analyst approval, making it suitable for security teams cautious about fully autonomous penetration testing agents.
Related articles
One Year Left to Secure Systems as Open-Source GLM-5.3-Flash Enables Automated Cyber Attacks
Chinese company Z.ai Co. released GLM-5.3-Flash in August 2026, an open-weight model that achieves 84.5% on CyberGym and 54.4% on ExploitBench, matching or exceeding leading commercial LLMs in vulnerability discovery and exploitation tasks. The model runs locally on consumer hardware such as a single Nvidia DGX Spark or Apple M5 Mac Studio with 256 GB unified memory, allowing unrestricted use after abliterated versions remove safety alignments. Experts warn that LLM agents could soon scan and exploit zero-days across Windows, Linux, browsers, and messaging apps around the clock. Initiatives Project Glasswing (Anthropic-led) and Daybreak (OpenAI-led) are racing to patch critical vulnerabilities in open-source projects and critical infrastructure before the next generation of unrestricted models arrives. Organizations are advised to accelerate patch deployment, inventory supply chains, and adopt advanced LLMs defensively within the remaining one-year window.
RFC 9421 and Open wbauth Protocol Accelerate AI Agents 5.5x by Replacing Anti-Detect Browsers with Cryptographic Signatures
A new open implementation of the IETF RFC 9421 HTTP Message Signatures standard called wbauth allows AI agents to authenticate using Ed25519 cryptographic signatures instead of resource-heavy anti-detect browser farms. The approach eliminates the need for Camoufox, Playwright, or AdsPower instances that consume 500 MB to 1.5 GB of RAM per process and require residential proxy pools. Benchmarks show cold start time dropping from 1744 ms to 5 ms, request time from 86.8 ms to 15.8 ms, and memory usage from 500 MB to 0.76 MB. The system uses three HTTP headers for signing and verification against a public key directory hosted on Cloudflare Workers and D1. Server-side validation at the WAF or edge involves fetching the public key, canonicalizing the message per RFC 9421, verifying the Ed25519 signature, and checking timestamps to prevent replay attacks. The npm package wb-auth@0.4.0 and PyPI package wbauth-sdk==0.4.0 provide ready-to-use signers for Node, Bun, Deno, Python httpx, and requests. The full source is available on GitHub under the MrKoriy/wbauth repository.
Critical Prompt Injection Flaw in ChatGPT GitHub Connector Allows Theft of Private Repositories
A critical vulnerability in the ChatGPT GitHub connector enables attackers to steal private repositories through indirect prompt injection. Researcher Sunil Tripathy demonstrated that hidden instructions placed in a public GitHub repository can trick the ChatGPT agent into accessing and exfiltrating data from the victim's private repositories. The attack works when the victim connects their GitHub account to ChatGPT with full repository access and then asks the agent to review the attacker's public repo. The injected instructions are executed as trusted commands, allowing the agent to commit malicious GitHub Actions workflows that exfiltrate secrets such as AUDIT_CANARY to attacker-controlled servers. Direct requests to steal data are refused by the agent, but framing the instruction as a deployment requirement bypasses this safeguard. OpenAI's documentation claims the connector is read-only, yet the attack achieves both read and write access across repositories. No CVE was assigned, the report was closed as out of scope on October 14, and the issue remained exploitable on October 15 with no published fix available.
Positive Technologies Adds LLM Firewall Module to PT Application Firewall for AI Service Protection
Positive Technologies has developed the LLM Firewall module as part of its PT Application Firewall solution to secure AI services against prompt injection attacks and data leakage. The module inspects both user requests sent to large language models and the responses generated by those models, detecting attempts to bypass restrictions, extract system instructions, or misuse agent capabilities. It specifically targets prompt injections hidden in documents or direct inputs that could override the model's original instructions. Additional detection covers personal data, passwords, access keys, and toxic or prohibited content in both directions of communication. The solution integrates via OpenAI-compatible APIs and is already available in PT AF Cloud, with deployment in PT AF PRO planned for later. Organizations can configure separate policies for different AI services, choosing between monitoring and blocking modes for requests and responses independently.