Pentesting firms don't want you to see this.
An open-source AI agent just replicated their $50k service.
A "normal" pentest today looks like this:
- $20k-$50k per engagement
- 4-6 weeks of scoping, NDAs, kickoff calls
- A big PDF that's outdated the moment you ship a new feature
Meanwhile, AI agents are quietly starting to perform on-par with human pentester on the stuff that actually matters day-to-day:
↳ Enumerating attack surface
↳ Fuzzing endpoints
↳ Chaining simple vulns into real impact
↳ Producing PoCs and remediation steps developers can actually use
And they do it in hours instead of weeks and at a fraction of the cost.
This approach is actually implemented in Strix, a recently-trending open-source framework (14k stars) for AI pentesting agent.
The framework spins up a team of AI "attackers" that probe your web apps, APIs, and code.
It then returns validated findings with exploit evidence, remediation steps, and a full PDF report that looks exactly like what you'd get from a traditional firm, but without a $50k invoice and a month-long wait time.
You can see the full implementation on GitHub and try it yourself.
Just run: `strix --target https: //your-app .com` and you are good to go.
Human red teams aren't disappearing but the routine pentest (pre-launch, post-refactor, quarterly checks) is clearly shifting to AI.
Strix is one of the first tools that makes that shift feel real instead of hypothetical.
I've shared the GitHub repo in the replies.