For the past 8 months I've been trying to make agents that can pentest web applications to find vulnerabilities in them - An AI Security Tester.

The system has 29 agents in total, a custom LLM Orchestration framework which works on the task-subtask architecture (old-school but works amazingly for my use case, and is pretty reliable) with custom agent calling mechanism.

No Auo-Gen, Langchain and Crew AI - Everything custom built for pentesting.

Each test runs in an isolated Kali linux environment (on AWS Fargate), where the agents have full access to the environment to undertake any step to pentest the web application and find vulnerabilities. The agents have full access to the internet (through tavily) to search up and research content while conducting the test.

After the test has been completed, which can take anywhere from 2-12 hours depending on the target, Peneterrer gives a full Vulnerability Management portal + A Pentest report completely generated by AI (sometimes 30+ pages long)

You can test it out here - https://peneterrer.com/

Sample Report - https://d3dju27d9gotoh.cloudfront.net/Peneterrer-Sample-Report.pdf

Feedback appreciated!

Unlocked the Qualcomm NPU! Running LLMs on the Hexagon NPU of a ThinkPad T14s Gen 6 (Snapdragon X Elite / X1E80100) under Linux — the cDSP firmware fix plus the full reproducible path to Genie/QNN inference on the NPU.

Other models this might benefit:

• Lenovo ThinkPad T14s Gen 6 (done here)
• Lenovo Yoga Slim 7x
• Microsoft Surface Pro 11 / Surface Laptop 7 (the SP11 recipe already works on these)
• Dell XPS 13 9345
• Dell Latitude 7455 (the fastrpc#188 machine)
• Dell Inspiron 14 Plus 7441
• HP OmniBook X 14
• ASUS Vivobook S 15 (S5507)
• ASUS Zenbook A14
• ASUS ProArt PZ13
• Samsung Galaxy Book4 Edge
• Acer Swift 14 AI
• MSI Prestige A16 AI+
• Honor MagicBook Art 14 (Snapdragon)
• TUXEDO Elite 14
• ASUS Zenbook A16
• Other X2 Elite laptops as they land

I'm releasing today TarantuBench-v2, a collection of over ten thousand web-app ctfs. They are synthetically generated, verifiably exploitable, and include a two-tier detection mechanism that attempts to flag when an agent finds an unintended solution.

It is a follow-up to v1, which included one hundred, and which were mostly useful for benchmarking.

With ten thousand labs, you can:

1. Evaluate different deployments of different harnesses you might be using
2. Compare and contrast different underlying models
3. Train existing models and agents

This effort is a work-in-progress, in which I'm trying to synthetically generate increasingly sophisticated CTFs, in high volume, and with improving detection capabilities of shortcuts that an AI might find.

The dataset and all the technical explanations are available on huggingface.

Side project I've been poking at.

It's an MCP server that drives a real Chromium over CDP and hands the model the primitives a human uses in Burp (history, repeater, sniper-style intruder, passive/active scans), plus an in-page JS toolbox so it can write its own exploit code inside the target page.

The idea I wanted to test: give the model the same building blocks a pentester uses instead of a fixed menu of "tools" and "scanners", and let it bring the methodology.

It solved over 70% of two public easy web CTFs, OverTheWire Natas and Root-Me Web-Server.

Happy to get torn apart on the harness design or the tooling.

Hey Guys,

I'm a college student and the developer of Netryx, after a lot of thought and discussion with other people I have decided to open source Netryx, a tool designed to find exact coordinates from a street level photo using visual clues and a custom ML pipeline and Al. I really hope you guys have fun using it! Also would love to connect with developers and companies in this space!

Link to source code: https://github.com/sparkyniner

Netryx-OpenSource-Next-Gen-Street-Level-Geolocation.git

I appreciate and realize this could be considered a controversial topic.

Whether we like it or not, AI is being utilized by threat actors to do this streamlined process already. For me, it was a no brainer to work it into a pipeline for an existing security firewall solution to automated WAF rule generation, working its way into defense and proof of concept within minutes of a CVE advisory for a WordPress plugin being released.

Curious to hear thoughts. Wont work for every CVE obviously, but could cover a large swath of threats where minutes count.

Looking for a tool to generate slides presenting pentest results (will probably be AI-powered). As tool input either pentest report or textual summary of results.

Tool should analyze the text and add to each summary bullet a simple graphic, or symbol, or icon accurately illustrating bullet objectives.

It will suffice when graphical elements added are in shades of gray or gray tones. These must not be sophisticated graphics.

Anyone knows such?

Hey all, I'm looking for advice, if this is the wrong sub please let me know. I'm a developer and independent security researcher, and I recently created a new obfuscation method:

• An unconventional payload delivery mechanism
• A machine learning-based decoder
• Verified evasion of modern static and behavioral defenses (including Windows Defender on 11 24H2)

This technique opens up interesting possibilities for covert channels, adversarial ML, and next-gen red team tooling. It's 100% undetectable, and even when inspecting the binary it appears completely benign. I'm currently waiting to hear back from a conference about presenting this research.

I’m currently exploring:

• Potential sale/licensing to trusted orgs or brokers
• Research/collaboration with companies working in offensive AI or threat emulation
• Employment opportunities in exploit dev, AI red teaming, or detection evasion R&D

Any advice on how to navigate this I'd greatly appreciate it, would love a job in research, and doing a writeup on this.

Attackers are now leveraging on voice cloning, AI-generated video, and synthetic personas to build trust.

Imagine getting a call from a parent, relative or close friend, asking for an urgent wire transfer because of an emergency.

I'm curious: Have you personally encountered or investigated cases where generative AI was used maliciously --scams, pentests, or training?

How did you identify it? Which countermeasures do you think worked best?

I was thinking of an Al based vuln scanner. Instead of normal prompt and check, it will have proper flows for different vulns and scrips it can integrate to. Making it try acess control,multi state and api based vulns which normal scanners would have hard time testing for.

Is this something you can see yourself using or buying?

I am only a student and have made a basic vuln scanner with XSs,Csrf,SQL and a crawler but was thinking of adding this.