Offensive Security

A plain-English, defensive look at autonomous AI penetration-testing frameworks — using the open-source Zen-AI-Pentest as a worked example. How the LLM "reason → act → observe" loop drives real tools, why "autonomous exploitation" is a different risk from a scanner, and the authorization, isolation and oversight questions to settle before one touches anything.

REA (Reverse Engineer Anything) is an open-source GitHub MCP server for AI-driven reverse engineering of apps and binaries. What the repo does, how to use it, and the defender's take.

Dolphin3-Cyber-8B, an abliterated "zero-refusals" security model, passed 44,000 downloads and runs on an 8GB laptop GPU. The AI governance checklist first.

Claude-Red packages 78 offensive-security skills for Claude, with no built-in authorization check. The governance checklist to put in place first.

Hacktron chained a libheif overflow, RCE on community.openai.com, and an SSO flaw into ChatGPT/Codex takeover and internal repo access in under 72 hours.

PentAGI is a 24k-star open-source AI agent that plans and runs pentests with Nmap, SQLMap and Metasploit. What it does and what to check before you run it.

Ars0n Framework v2 is an open-source bug bounty recon platform that wraps 50+ tools, ranks targets by ROI, and teaches you while you hunt. A 3-minute tour.

RedCell is an open-source AI agent that plans and runs a full penetration test with nmap, nuclei and Metasploit, then writes the report. How it works and its limits.