PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

pentestkit: Autonomous Multi-Agent Penetration Testing Framework Powered by LLMs

github.com | tool | #ai-security | #bug-bounty | #pentesting | #benchmark | #red-team | #llm | #cvss | #multi-agent | #claude-agent-sdk | #kimi
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

An autonomous multi-agent pentest framework built on the Claude Agent SDK and powered by Kimi K3, achieving 104/104 (100%) on the XBOW benchmark with proven findings and CVSS v3.1 scoring.

Why it matters

Demonstrates the frontier of autonomous LLM agents in real-world offensive security, bridging end-to-end vulnerability discovery, rigorous proof-of-exploit verification, and automated reporting.
Published
Collected

Related coverage

tool · projectdiscovery.io
Inside the benchmark: app architectures, walkthroughs of findings, and what each scanner actually caught
Part 2 of the vibe coding benchmark dissects three AI-built apps (healthcare, banking, insurance), detailing what Neo caught, what Claude Code got wrong, and what both missed on AI-generated code.
tool · projectdiscovery.io
Enhanced Team Management, 2FA, and Asset Filtering - PDCP (v0.8.7)
We are pleased to unveil our latest release of ProjectDiscovey Cloud Platform, v0.8.7, packed with features that streamline team management, enhance security, and improve asset operations—particularly for enterprise security engineers. Read on to learn what's new. Multi-Team Creation & Member Segregation We've introduced the ability to create multiple teams, providing greater flexibility and control over project management. Create multiple teams Segment users and teams, centralize b
tool · projectdiscovery.io
March 2024 Newsletter
The latest release of Nuclei, v3.2, introduces significant updates aimed at enhancing the security scanning capabilities of the Nuclei engine.
tool · projectdiscovery.io
Introducing Chaos Bug bounty recon data API
We’re proud to announce release of our Chaos Bug bounty recon data API today. This API will allow hackers to get instant data on targets of their choice without running any additional tools at just single hit of request. Goals behind the project Reconnaissance is complex, it requires a proper setup and not everyone is equally good at it. People are skilled differently, some are amazing at looking at Web Attack Surfaces, some prefer to dive deep into logic bugs. Being good at recon requires some
blog · xbow.com
Grok 4.7 Is Different. So Is the Best Way to Use It.
XBOW tested Grok 4.7 on exploit crafting and agentic pentests: inside xAI's Build it improved substantially over 4.6, outside Build it slipped slightly—orchestration now matters as much as prompts.
blog · aikido.dev
Aikido launches external network pentesting
TL;DR: Aikido now pentests your external network. Attackers already test your perimeter every day, and with AI agents doing the grunt work, they're faster than ever. Now you can run the same test first. Give our agents one domain and they'll map the internet-facing systems you run and attack them from the outside, exactly like a malicious actor would.
Back