# Automating Penetration Testing with LLM Integration New open-source tool leverages uncensored language models for web and cloud security testing. - **Source:** [Blackhat Library: Hacking techniques and research](https://brifing.si/source/db9781c6-35bf-45b9-adcf-0c48b6e0ed91) - **Published:** 2026-11-12 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/d7498f90-5e43-4579-b54e-f44b0ec35f5d ## AI-Assisted Security Testing A new security tool has been released to assist researchers during bug bounty engagements. It focuses on web and cloud blackbox penetration testing, utilizing Large Language Models to guide the process. The project is hosted on GitHub under the name tradecraft, allowing security professionals to integrate AI into their existing testing workflows. ## Model Configuration Requirements The tool specifically requires an uncensored LLM to function effectively. The developer utilized the HauhauCS/Qwen3.8-27B-Uncensored-HauhauCS-Aggressive-MTP-GGUF model. Optimal performance was achieved using IQ4_XS quantization combined with a Q8 KV cache. These specific technical settings ensure the model remains responsive and accurate during complex security analysis tasks performed by the automated testing engine. ## Memory and Context Limits To maintain efficiency during long testing sessions, the developer implemented strict constraints on the model's memory usage. The conversation history is restricted to 64k tokens, while the total context cap is limited to 128k. These parameters were determined through testing to yield the most reliable results for web and cloud-based security assessments. ## Dataset Transformation Engine A core feature of this project is its built-in engine designed to transform active engagements into structured datasets. This functionality allows users to fine-tune the underlying models based on their specific findings. By continuously feeding engagement data back into the system, the AI's performance improves over time, becoming more effective at identifying vulnerabilities. ## Attack Chain Logic The tool supports the creation of skills, which are defined as attack chain logic utilizing available adapters. These adapters act as modular components that the AI uses to navigate security testing scenarios. Users are encouraged to contribute their own custom adapters and attack logic to expand the tool's capabilities for the broader community. ## Community-Driven Development The project is open-source and relies on community contributions for its continued evolution. Users can support the development by starring the repository or submitting new adapters used during their own security engagements. This collaborative approach aims to build a shared library of attack patterns that benefit all researchers using the platform. ## Blackbox Testing Methodology Blackbox penetration testing involves assessing a system without prior knowledge of its internal architecture. By applying LLM guidance to this methodology, the tool attempts to automate the discovery of security flaws. This approach reduces the manual burden on researchers, allowing them to focus on complex logic errors that require human intuition. ## Future of AI Security The integration of fine-tuned models into security tooling represents a shift toward more autonomous vulnerability research. As these tools learn from real-world engagements, they become increasingly adept at identifying sophisticated threats. The success of this project will depend on the community's willingness to share data and refine the underlying attack logic. ## Sources covering this story - https://www.reddit.com/r/blackhat/comments/1xum2z1/pentest_with_ai/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._