Hack in a box: Local Language Models for automating Red Teaming and penetration testing

Local Language Models for Automating Red Teaming and Penetration Testing

Speakers: Thomas O (Skjortan), CTO, Fio

Conference: Security Fest

YouTube: https://www.youtube.com/watch?v=8nUNZVAtl94

Overview

In his Security Fest talk, "Local Language Models for automating Red Teaming and penetration testing," Thomas O (Skjortan), CTO of Fio, delves into the ambitious endeavor of leveraging local Large Language Models (LLMs) and AI agents to automate significant portions of red teaming and penetration testing workflows. The presentation highlights the speaker's journey in building an MCP (Model-tool Communication Protocol) server that integrates various hacking tools, aiming to streamline and enhance the efficiency of security assessments. Thomas O shares candid insights into the current state of both traditional pentesting tools and nascent AI agentic frameworks, ultimately presenting a proof-of-concept system designed to tackle the tedious and repetitive aspects of security testing.

The talk is particularly relevant in an era where AI hype often overshadows practical application. Thomas O cuts through this, offering a grounded perspective on what AI agents can realistically achieve today—and where their limitations lie. His work addresses a critical pain point for many pentesters: the "broken" and disjointed nature of existing toolchains, which often require significant manual effort and custom scripting to function effectively. By demonstrating a system that allows LLMs to interact with and orchestrate hacking tools locally, he showcases a pathway towards more efficient and collaborative red teaming, while also emphasizing the continued indispensable role of human expertise.

This presentation matters because it bridges the gap between theoretical AI capabilities and their concrete implementation in cybersecurity. It provides a blueprint for how security professionals can begin to integrate AI into their daily operations without relying on external, potentially insecure, cloud-based LLM providers. Furthermore, it serves as a stark reminder of the underlying challenges in the security tool ecosystem, prompting a call for greater standardization and reliability. The speaker's open-sourcing of the MCP server component encourages further community development and adaptation, paving the way for a new generation of AI-augmented security testing methodologies.

Background

▶ Watch: Introduction to automating red teaming with local LLMs (0:00)

The genesis of this project stems from a fundamental frustration shared by many seasoned penetration testers: the inherent inefficiencies and "broken" nature of traditional hacking toolchains. Thomas O, drawing from decades of experience in hacking and pentesting (dating back to when it was simply "hacking," not "pentesting"), laments the current state of widely used tools like Nmap, Nessus, and Metasploit. He vividly describes Nmap's unreliable completion estimates and lack of modern output formats (like JSON), Nessus as "super broken," and Metasploit's slow search capabilities as significant hurdles in day-to-day operations. This disjointed ecosystem often forces pentesters to spend excessive time on manual orchestration, data parsing, and custom scripting to make tools work together, diverting focus from higher-value analytical tasks. The speaker even proposes a hypothetical HCP (Hacking Control Protocol) as a desired standard to unify security tool communication.

In parallel with these operational challenges, the cybersecurity world is experiencing a surge in AI hype, particularly around AI agents. These autonomous AI systems are promoted as capable of performing complex tasks, making decisions, using tools, and collaborating. However, Thomas O offers a critical, albeit humorous, assessment: "My takeaway on agents after having done this research is it's a glorified for loop." He explains that current agentic frameworks often involve iterative attempts by the LLM, correcting errors through repeated executions—essentially a sophisticated trial-and-error loop. Despite this skepticism, he recognizes the potential of agents to automate repetitive tasks, making them an ideal candidate for orchestrating the often-monotonous phases of pentesting.

The talk is built upon the relatively new Model-tool Communication Protocol (MCP) standard. MCP emerged as a way for AI models to interact seamlessly with external tools and services, enabling them to execute commands, process results, and make decisions. The speaker initially approached MCP with skepticism, fearing it would be "stupid standard for something like a Docker container which is just going to add stuff and fluff around my for loops." However, he soon realized its utility as a standardized communication protocol, essentially a glorified REST API with streaming capabilities, allowing LLMs to effectively utilize a diverse set of tools. This protocol, despite its current lack of robust authentication mechanisms and significant security implications (especially when running with user privileges, as seen in "vibe coding" tools like Cursor), forms the technical backbone of his automated red teaming server.

Key Findings

▶ Watch: Demystifying AI agents: "glorified for loops" (4:55)

The primary contribution of Thomas O's work is the development and open-sourcing of an Android Team MCP server designed to integrate a suite of hacking tools for automated red teaming and penetration testing. This server acts as a central hub, allowing various AI agents (or "for loops," as he affectionately calls them) to interact with and orchestrate these tools, sharing a common truth source via a MongoDB database. This architecture addresses the inherent fragmentation of existing pentesting toolchains by providing a standardized, programmatic interface for AI-driven automation.

A significant finding, repeatedly emphasized throughout the talk, is the "broken" state of many conventional pentesting tools. Thomas O highlights specific deficiencies: Nmap's inability to provide JSON output and accurate time estimates, Nessus's overall unreliability, and Metasploit's slow search functionality. He found that even seemingly robust tools like Nuclei required extensive template rewriting for accurate vulnerability detection in a controlled environment. This underscores a critical gap in the security industry: a lack of standardized, reliable, and easily integratable tools that can natively support modern automation workflows.

Another key finding revolves around the remarkable advancements in local Large Language Models (LLMs). The speaker notes that just 12 months prior, running a 32-billion parameter model locally would have been unthinkable. Thanks to significant optimization and research—particularly from Chinese developers who, due to hardware limitations, "optimized the crap out of their models"—there has been a 10x increase in performance and a 100x price drop for running LLMs locally within the last 18 months. He specifically mentions using Quen 3 models and 4-bit quantization on a Mac Mini, achieving better performance than smaller 16-bit models. This breakthrough eliminates the need to send sensitive hacking data to third-party cloud LLM providers, making local, secure AI-driven automation a practical reality for red teams.

Finally, Thomas O concludes with a pragmatic perspective on AI's role in pentesting: it won't replace human pentesters but will augment them. While AI agents are adept at the "tedious part" – identifying patterns, testing multiple payloads, and executing repetitive tasks – they lack focus and require human guidance. He humorously compares them to "a bunch of kids running around trying to do stuff," emphasizing that human orchestration remains crucial to direct agents toward high-value targets and prevent them from going "off on a tangent." Furthermore, he points out the burgeoning problem of AI-generated "crap" code, noting that GitHub commit frequency has doubled, with a significant portion being AI-generated, leading to an increase in security vulnerabilities that still require human auditors to detect.

Technical Deep Dive

▶ Watch: Explaining the MCP workflow for automated pentesting (5:40)

The core of Thomas O's solution is an Android Team MCP server, designed to act as a centralized orchestrator for various hacking tools, enabling AI agents to interact with them programmatically. The server leverages the Model-tool Communication Protocol (MCP), a standard that allows any AI model to interact with any tools and services. MCP, in essence, functions as a glorified REST API that supports streaming, giving the perception of faster results to humans, even if the LLM's processing time remains constant. In Python, tools are made available to agents by simply marking them as @mcp_tool, allowing them to be exported and called by any agent.

The architecture envisioned by Thomas O for a minimalistic automated pentest involves several key components:

1. Port Scanner: Initially, Nmap was considered but rejected due to its lack of JSON output and unreliable performance. The speaker instead opted for Masscan, which provides single-line JSON output asynchronously per detected port, perfectly suiting the needs of an automated system. A custom banner grabbing function was also implemented as Masscan lacks this capability.
2. Vulnerability Scanner: Nessus was deemed "super broken." The chosen alternative was Nuclei, a template-based scanner. However, the speaker discovered that many of Nuclei's detection templates required significant rewriting to accurately identify vulnerabilities in a controlled, vulnerable environment, highlighting a common challenge with out-of-the-box security tools.
3. SSH Access: A standard SSH client module was integrated to verify access post-exploitation and for post-exploitation activities.
4. Exploitation Framework: Metasploit was integrated, but its native search functionality was found to be too slow. To overcome this, a custom tool was built to index all available Metasploit exploits and their associated CVEs into the MongoDB database, allowing for rapid, searchable access by AI agents. This enables agents to automatically search for and execute exploits based on identified vulnerabilities.
5. Discovery Modules: Basic discovery functionalities were included, such as subdomain resolution.
6. Database (Common Truth Source): MongoDB was chosen to store all gathered information—scans, findings, and indexed exploits. This central database allows multiple agents and human pentesters to work collaboratively, sharing knowledge and ensuring that agents can continue working on previously gathered information. The database structure includes collections for scans (port data), findings (vulnerabilities), and exploits (indexed Metasploit data).

A crucial aspect of the server's design is its asynchronous processing capability. Agents can initiate multiple tasks (e.g., a port scan, a vulnerability scan, a DNS lookup) in parallel without blocking the main agent's operations. This is demonstrated by the ability to query the LLM about "why the sky is blue" while complex scanning tasks run in the background. The tasks command allows users to monitor the status of these parallel operations.

The speaker also introduced the concept of specialized agents. Instead of a single monolithic agent, it's more effective to have a "virtual team" of agents, each specialized in a particular domain (e.g., a "Linux hacking guy," a database specialist, a reporting agent). A primary agent can call these specialized agents as tools, providing them with focused prompts and tools to perform specific sub-tasks. This modular approach helps prevent agents from getting "confused" or going "off on a tangent" when presented with too many options or a broad task. For instance, a hack_machine tool could internally call another agent specifically optimized for machine exploitation.

The entire system is designed to run on local LLMs, eliminating the need for external API calls to cloud providers. Thomas O demonstrated this on a Mac Mini, utilizing Quen 3 models with 4-bit quantization to achieve high performance with 32-billion parameter models. This local execution capability is a direct result of recent advancements in LLM optimization, particularly from the Chinese community, leading to a 10x performance increase and a 100x price drop for local LLM inference over the past 18 months. This makes it feasible and secure for red teams to deploy AI without compromising sensitive data.

Demo / Proof of Concept

▶ Watch: Presenting the open-source Red Team MCP server (6:40)

The live demonstration showcased the capabilities of the Android Team MCP server, illustrating how AI agents can orchestrate various hacking tools. The intended workflow involved a discovery phase, port scanning, vulnerability scanning, exploitation, and post-exploitation.

Initially, the speaker attempted a subdomain resolution for goofio.com, which faced a minor hiccup due to DNS issues over the VPN connection. However, this provided an opportunity to demonstrate the asynchronous nature of the system. While network issues were being addressed, the speaker initiated a full discovery scan on a target IP address (10.0.2.4 on port 8080). Critically, the system allowed the speaker to simultaneously query the AI with a general knowledge question ("why is the sky blue?"), demonstrating that the LLM was not blocked by the ongoing security tasks. The tasks command was used to monitor the parallel execution of the port scan and the LLM's reasoning process.

The core of the exploitation demo focused on a deliberately vulnerable Drupal server. The agent was instructed to "hack 10.0.2.4 on port 8080." The MCP server logs displayed the agent's thought process: initiating a penetration test, calling banner grabbers, searching existing findings, and enumerating vulnerabilities. The system successfully identified a critical vulnerability, CVE 2018-7000, affecting Drupal. The agent then proceeded to execute the corresponding Metasploit exploit. Although a direct shell connection couldn't be established back to the speaker's machine due to the persistent VPN routing problems, the system confirmed "checking result true," indicating that the exploit had been successfully launched and the target was compromised.

Finally, the demo concluded with the agent generating a "report on what we discovered," showcasing its ability to synthesize findings from the database into a summary, even if the prompts for report generation could be further refined. The overall demonstration, despite the live hacking challenges inherent in conference settings, effectively highlighted the system's ability to automate reconnaissance, vulnerability detection, and exploitation against a known vulnerable target using local LLMs and integrated tools.

Defensive Implications

▶ Watch: Deep dive into the MCP standard and its benefits (7:35)

The advancements demonstrated in this talk carry significant implications for defensive security strategies. The ability to automate reconnaissance, vulnerability scanning, and even initial exploitation using AI agents means that attackers can potentially scale their efforts much more efficiently. Defenders must recognize that the "boring stuff" of initial attack phases can now be automated, allowing adversaries to focus their human talent on more sophisticated, high-value targets or custom exploit development. This necessitates a shift towards continuous, automated defense mechanisms that can rapidly detect and respond to these initial automated probes.

The speaker's candid assessment of "broken" traditional pentesting tools (Nmap, Nessus, Metasploit) serves as a critical wake-up call for defenders. If the tools designed to find vulnerabilities are themselves unreliable or difficult to integrate, then defensive assessments might be incomplete or inefficient. This highlights a pressing need for improved, standardized, and interoperable security toolchains, perhaps even a "Hacking Control Protocol (HCP)" as proposed by the speaker. Defenders should prioritize investing in tools that offer robust APIs, modern output formats (like JSON), and reliable performance to enable their own automation efforts and integrate them into broader security orchestration platforms.

The security implications of MCP itself, particularly the noted lack of native authentication patterns, are also crucial for defenders to consider. While the speaker's project runs locally, the broader adoption of MCP in "vibe coding" tools underscores the risk of external LLMs executing commands with user privileges. Defenders and security architects must implement stringent access controls, network segmentation, and monitoring for any AI-tool integration points to prevent unauthorized command execution or data exfiltration.

Furthermore, the observation that AI-generated code is often "terrible" and contributes to a doubling of commit frequency on GitHub presents a growing attack surface. Defenders need to anticipate an increase in software vulnerabilities stemming from AI-assisted development. This requires enhanced focus on automated code analysis (SAST/DAST), robust peer review processes, and developer education to mitigate the risks associated with hastily generated, potentially insecure code. The speaker's work suggests that while AI can help find vulnerabilities, it can also inadvertently create them, leading to a perpetual arms race where human expertise in code auditing remains paramount.

Ultimately, the talk reinforces that AI will not replace human security professionals but will augment them. Defenders must learn to work with AI, orchestrating intelligent agents to automate routine tasks, thereby freeing up human experts to focus on complex threat intelligence, strategic defense planning, and the nuanced analysis that AI currently cannot replicate.

Key Takeaways

• Traditional pentesting tools are "broken": Nmap, Nessus, and Metasploit are criticized for their lack of modern features, unreliability, and poor integration capabilities, necessitating significant manual effort.
• AI agents are "glorified for loops" but powerful for automation: While current AI agent frameworks are essentially iterative trial-and-error systems, they are highly effective at automating tedious, repetitive tasks in penetration testing.
• MCP enables AI-tool interaction but has security caveats: The Model-tool Communication Protocol provides a standardized way for LLMs to use external tools, but its current lack of robust authentication mechanisms poses significant security risks if not properly managed.
• Local LLMs are a game-changer for secure automation: Recent advancements (10x performance, 100x price drop, 4-bit quantization) make it feasible to run powerful 32-billion parameter models locally, eliminating the need to send sensitive hacking data to cloud-based LLM providers.
• AI augments, not replaces, human pentesters: AI agents excel at pattern recognition and execution of routine tasks, but they lack focus and require human orchestration to target high-value assets and perform complex, nuanced analysis.
• AI-generated code increases the attack surface: The proliferation of AI-generated code, often of poor quality, is doubling the rate of new code commits and likely introducing more vulnerabilities, demanding increased vigilance from defenders.

About the Speaker(s)

Thomas O (Skjortan) is a seasoned cybersecurity professional with a long history in the field, having started hacking even before the term "pentesting" became common. His experience with AI and Machine Learning also predates the modern "AI" moniker, going back to early neural network simulations in university. Currently, Thomas serves as the CTO of Fio, a company specializing in code audits of highly critical infrastructure systems, particularly in the Web3 space, including core infrastructure code for layer-one blockchains. His work at Fio also encompasses boundary anti-fishing and various other cyber security services. This extensive background in both offensive security and deep technical auditing provides him with a unique perspective on the practical challenges and potential solutions presented by emerging technologies like AI.