AIRecon: AI-Powered Penetration Testing Tool with Kali Linux Sandbox

https://cybersecuritynews.com/airecon-penetration-testing-tool/

Publish Date: 2026-06-18 04:43:00

AIRecon is an autonomous penetration testing agent that runs entirely offline, combining a self-hosted Ollama LLM with a Kali Linux Docker sandbox to automate end-to-end security assessments without exposing any data to the cloud.

Developed by researcher pikpikcu, it eliminates the prohibitive cost of commercial API-based models like GPT-4 or Claude for recursive recon workflows that can demand thousands of LLM calls per session.

Commercial AI-powered security tools send target intelligence to external servers and require ongoing API subscriptions. AIRecon flips this model entirely; all tool output, vulnerability reports, and session data stay on the operator’s machine.

It integrates natively with Caido proxy, offering five built-in tools: list, replay, automate (using §FUZZ§ markers), findings, and scope management. This makes it particularly well-suited for bug bounty hunters and red teamers who operate under strict data-handling policies.

AIRecon structures every engagement through four automated phases, each with defined objectives, recommended tools, and automatic transition criteria. Phase enforcement is intentionally soft; the agent is guided but never blocked, and checkpoints fire every 5 iterations (phase evaluation), every 10 (self-evaluation), and every 15 (context compression).

The full stack includes the Kali sandbox, browser automation, a custom fuzzer, Schemathesis API fuzzing, and Semgrep SAST for static source analysis.

AIRecon Tool

One of AIRecon’s standout features is its optional airecon-dataset companion, which indexes approximately 1.09 million security records into local SQLite FTS5 databases including CVEs, red team techniques, CTF writeups, Nuclei templates, and bug bounty payloads all completely offline.

The LLM autonomously calls dataset_search before attempting unfamiliar techniques, grounding its decisions in real indexed data rather than pure hallucination. Session memory persists in…

Source