InfoSecBulletin Cybersecurity for mankind
PentesterFlow is a new open-source AI tool for command lines. It is made for penetration testers and bug bounty hunters. It helps automate the work from finding problems to reporting them, while still allowing analysts to oversee the process.
Most AI security tools have fake findings, weak context memory, and bad tool connections. PentesterFlow deals with these issues directly by having built-in pentest skills, confirming findings with evidence, and learning continuously.
NIST to Modernize NVD in the Age of Artificial Intelligence
ALERT
Multiple TP-Link Flaws Allow to Bypass Auth and Escalate Privileges
LiteLLM supply chain attack reveals 153GB of stolen credentials online
PATCHCORD Backdoor Targets Telecom and CII In South Asia
Fortinet Fixes Multiple Flaws in FortiWeb, FortiManager, and FortiClient
“City-Forum” Campaign
“City-Forum” Campaign Attacks Salesforce and ServiceNow Instances Worldwide
Palo Alto Patches 11 New flaws Across PAN-OS, GlobalProtect, and Prisma Access
CVE-2026-20349, CVE-2026-68820
Cisco and Windows patched zero days exploited in attack
Microsoft Patch 394 Flaws, Including 3 Zero-Days
AI Finds Nation-State-Level Zoom Flaw in Under 24 Hours, Zero-Click Attack Exposed
The tool links to local or online large language models, makes plans for a specific target, runs real security tools, and needs clear approval from the analyst before using sensitive commands.
This “human-in-the-loop” design ensures the AI never runs wild on production systems without a security engineer’s sign-off, addressing a major trust gap in autonomous pentesting tools.
PentesterFlow is made to help with every stage of a pentest: planning, researching, gathering info, checking, tracking coverage, making reports, and learning.
A live demo shows the tool loading a “webvuln” skill, sending HTTP requests to test an orders API, and automatically confirming a high-severity IDOR (Insecure Direct Object Reference) vulnerability, writing evidence-backed findings straight to a Markdown file.
A key part of PentesterFlow is its local Continuous Learning System. This system quietly saves user choices, effective methods, areas that need work, and lessons from mistakes in files that are specific to each project and personal use. This helps make future sessions better without needing to retrain the main model.
Secrets are removed before being saved, and duplicate memories are cleaned up before going to the model. This makes the process easy, even as it gets smarter over time.
PentesterFlow on GitHub makes sure that only the right people can use certain tools. It stops bad shell commands and hides passwords when saving and taking snapshots. It also has a “YOLO mode” that lets actions be approved automatically in safe lab settings.
It connects straight to Burp Suite using a helper tool, allowing testers to send captured traffic to the CLI and bring back confirmed findings as Burp issues for a smoother process between manual and AI-assisted testing.
Installation is easy. Use a shell script for macOS/Linux or a PowerShell command for Windows. It will get the latest binary and check its SHA-256 checksum.
Users can pin specific versions, choose local LLMs like Ollama’s qwen2.5-coder model, or connect to hosted providers such as Gemini and Groq, then set a target URL with a simple /target command before instructing the agent in plain English, such as “test the orders API for broken access control.”
Analysts who work with sensitive targets should remember that PentesterFlow is meant only for approved security tasks. It can run shell commands and make live HTTP requests after getting the right approvals.
Related Post
Anthropic Unveils Claude Security Plugin for Code Flaw Scanning
