Today was my first dive into utilizing an open source project for AI-lead pentesting.
Hardware and Setup
For specs, I have a Ryzen 7 9800X3D 8-core processor, 32GB DDR5 RAM and an 8GB GTX 2070 GPU. Admittedly my GPU is the bottleneck here, and unfortunately the GPU is the most critical component. However, it does work, just rather slow.
For the LLM, the best one that I could find that was rather performant, properly formatted the tool_call the correct way, and could fully fit in my GPU memory was Ornith-1.0-9B-GGUF which is 5.63 GB. I spent several hours testing qwen and gemma based models but could not get it to properly call the required tools the correct way, even with a new custom prompt template. I am using LM Studio to load the model and run the API. I have my context length set to 262144, GPU offload to 32, Keep Model in Memory checked, and Offload KV Cache to GPU Memory unchecked. The latter is what drastically slows down the token output, however due to the large input tokens provided by the harness, I quickly max out my VRAM and would fail to output tokens.
For the harness, I stumbled upon Strix, one of the top open-source projects on GitHub for #ai-hacking. This is running inside a Kali Linux 2026.1 VM inside of VMware Workstation. I have the network bridged to allow it to connect to my host for the LLM. It runs out of a docker container. For it to connect back to LM Studio, the following variables need set before launching:
export STRIX_LLM="openai/local-model"
export LLM_API_BASE="http://10.0.0.0:1234/v1"
I also have a copy of DVWA that I modified the compose.yml to bind to 0.0.0.0. I found if I tried connecting to localhost or via IP, the docker container harness could not reach the docker container web app.
Testing
After hours of tweaking the configuration, I finally get the test launched with:
$ strix --target http://10.0.0.1:4280/login.php --instruction "use credentials admin:password to auth"
Now again, the output is SLOW, but it does work and spawn multiple agents to begin testing.
It's able to run multiple commands and spin up other agents to perform other actions simultaneously. It can also take pictures for compiling a report.
Conclusion
The biggest hurdle that I still need to overcome is determining if there is a way to increase token output without a hardware upgrade. The foundation is properly set to allow the multi-agentic harness to begin performing penetration testing, but it just needs to be extraordinarily faster.