How an agentic pentest works:
one orchestrator, many hands, a shared blackboard.
Published 2026-09-11 · Updated 2026-09-13
An agentic pentest works a target as a four-level tree. A local orchestrator plans, spawns scoped subagents in parallel batches, and each subagent drives real Kali tooling against the assets it discovers — writing everything to a shared blackboard so a discovery by one agent is tested by another.
What makes an agentic pentest AI-driven, not scripted
A scanner and a fixed playbook follow the same steps every time. An agentic pentest does not: the local model reads what it finds, decides what to try next, writes its own scripts, and chooses which tool fits the target in front of it. It plans, delegates and re-plans as evidence lands on the blackboard, so the depth of a run is driven by the estate under test rather than by a preset checklist — while every action still passes the scope guard before it runs.
Plans & delegates
The local model reads the scope, picks a capability-aware plan, kicks off the deterministic sweep, then decides which hosts and services deserve a subagent — and in what order.
Work in parallel
Purpose-built subagents — recon, web, api, identity, AD — run concurrently in persist mode. Each owns a slice of the surface and reports back to the blackboard.
Drive real tradecraft
Subagents call 32 real offensive tools in a Kali sandbox — plus arbitrary bash and python. Every invocation is checked against the scope guard before it runs.
Correlate to attack paths
Findings are CVSS-scored on the blackboard. A confirmed Critical/High triggers a focused deep-dive, and cross-asset correlation turns single issues into full attack chains.
It doesn’t stop at the first host.
Every subagent discovery — a new subdomain, an API host named in a JS bundle, a domain controller reachable over SMB — is scored for interest and, if it clears the bar and passes scope, becomes a new node the orchestrator can recurse into. The tree grows toward risk and stays inside your boundary.
Shared memory is what makes it a team.
Subagents don’t work in isolation. Findings, credentials, hosts and hypotheses land on a shared blackboard the whole swarm reads. A secret the web agent pulls from a JS bundle is picked up by identity and replayed against an endpoint the api agent mapped — correlation no single tool would make.
No fixed step cap.
Human pentesters stop when they’re out of hours. R0 stops when the surface is exhausted. Subagents run in persist mode — the model itself decides there is nothing left worth trying, rather than hitting an arbitrary iteration limit.
See R0 run against
a target of yours.
A continuous, autonomous red team on hardware you own — no data ever leaves the box.