DarkMoon Launches Open-Source Autonomous AI Penetration Testing Platform

DarkMoon, an open-source automated penetration testing platform that orchestrates security assessments using artificial intelligence agents, launched its initial release on June 29, 2026. Licensed under the GNU General Public License v3.0, the platform discovers open ports, fingerprints technology stacks, and dispatches specialized sub-agents to execute offensive security operations through a controlled execution boundary.

Reasoning Layer Separated from Tool Execution

The platform isolates the reasoning engine from the software utilities that execute security commands. This architecture relies on an orchestrator called OpenCode, which is a TypeScript-based coding agent fork. OpenCode communicates with a configured large language model (LLM) to plan assessment phases and delegate tasks to a controlled execution layer.

This execution layer runs on the Model Context Protocol (MCP), an open standard that governs how AI models interact with external applications. Instead of granting the LLM direct, unrestricted access to a local terminal, the MCP acts as a gatekeeper. All command inputs and outputs pass through this interface.

“The LLM never executes arbitrary commands directly,” Mehdi Boutayeb, the lead maintainer of DarkMoon, told Help Net Security. Boutayeb explained that the MCP “exposes only an explicit allow-list of authorized tools and workflows,” keeping the AI’s operations strictly within the pre-defined scope of the assessment.

Automated Multi-Phase Testing Pipeline

Unlike traditional scanners that execute fixed sequences of checks, DarkMoon behaves as an active security coordinator. The system adapts its actions based on the specific services and structures it discovers.

When targeted at an authorized network or application, the platform follows a structured seven-step workflow:

1. Environment Discovery: The system scans the target to locate open ports, active services, and operational network protocols.
2. Technology Fingerprinting: It probes identified open ports to determine the underlying software stacks, including web frameworks, content management systems (CMSs), and application programming interfaces (APIs).
3. Attack Surface Modeling: The engine maps discovered entry points and identifies potential attack paths.
4. Agent Dispatch: It deploys specialized sub-agents tailored to the identified technologies.
5. Reactive Scanning: The system runs a continuous vulnerability scan loop, adapting dynamically as new endpoints or assets surface.
6. Evidence Collection: The platform gathers raw data, transaction logs, and execution traces to verify vulnerabilities.
7. Report Generation: It compiles validated findings into structured, publication-ready security reports.

This pipeline matches established industry methodologies, including ISO 27001, NIST SP 800-115, and MITRE ATT&CK modeling. By mapping the environment before launching tools, the system avoids wasting bandwidth on irrelevant tests.

Orchestrating 18 AI Agents and 80+ Security Tools inside Docker Containers

The platform integrates 18 specialized AI agents for distinct environments, such as web applications, Active Directory, Kubernetes clusters, and legacy network protocols. Active Directory agents assess domain hierarchies and user permissions, while Kubernetes agents audit container configurations.

These agents coordinate operations across more than 80 integrated offensive security tools. To protect the host environment from unintended side effects and dependency conflicts, the platform runs the entire security suite inside isolated Docker containers.

The integrated open-source toolbox includes:

• Nuclei: A vulnerability scanner that relies on YAML-based templates to identify system weaknesses.
• sqlmap: An engine designed to detect and exploit SQL injection vulnerabilities in database layers.
• BloodHound: An active directory visualizer used to map permission relationships and identify hidden attack paths.
• NetExec: A multi-protocol scanner used to assess administrative permissions and run commands across network protocols.
• Naabu: A network port scanner designed to discover active hosts.
• httpx: A command-line web utility used to probe HTTP endpoints and extract server headers.
• ffuf: A web fuzzer built to discover hidden directories and file paths on web servers.

Operators can extend this collection by adding proprietary scanners or custom tools. Developers can install additions directly into the dedicated toolbox container, register them on the MCP server’s allowed tools list, and expose them to the OpenCode orchestrator.

Installation and Execution Commands

To set up the platform with local engines like Ollama or llama.cpp, users run the main installation script. Running the tool locally with Ollama requires passing specific configuration flags, as shown in the following setup command:

sudo ./install.sh YOUR-KEY --local --local-engine ollama --local-url http://localhost:11434/v1 --local-model glm-4.6:32b

Alternatively, to configure the platform for local execution using llama.cpp, operators use:

sudo ./install.sh YOUR-KEY --local --local-engine llama.cpp --local-url http://localhost:8001/

For clean setups or full-stack resets, operators execute the baseline installer:

./install.sh

Once installed, operators launch an assessment using the primary control script:

./darkmoon.sh

Vulnerability Validation and Evidence Capture

To minimize false positives, DarkMoon enforces strict validation rules. The system separates findings into distinct classifications based on verified proof rather than theoretical vulnerabilities.

Weak indicators—such as generic HTTP status codes, reflected payloads that do not execute, or ambiguous banner grabs—remain classified as unconfirmed. A finding is only promoted to confirmed status when the platform captures positive execution proof.

When DarkMoon validates or exploits a flaw, it preserves the complete transaction history. The final security report documents:

• The exact command executed by the sub-agent.
• Raw tool outputs and logs.
• Full HTTP request and response headers.
• Execution traces and payload behavior.

Users can view these results in real-time through a live web dashboard that tracks ongoing campaigns, or export completed assessments as Markdown or PDF files.

Model Constraints and Safety Refusals

The platform supports both cloud-hosted commercial models and locally deployed language models. Supported cloud providers include OpenAI, Anthropic, and OpenRouter, while Ollama and llama.cpp run local models on self-hosted hardware.

However, commercial cloud models introduce challenges due to vendor-enforced safety guardrails. During initial platform testing, Anthropic’s Claude Opus 4.8 model triggered automated safety classifiers that blocked offensive operations mid-scan, even when targeting authorized networks.

Conversely, Claude Opus 4.6 completed identical assessments end-to-end without triggering refusals. DarkMoon’s maintainers recommend Opus 4.6 for consistent results, or advise organizations to enroll in Anthropic’s Cyber Verification Program to whitelist authorized testing.

Additionally, the system documentation warns that small-parameter models (such as 7B or 13B models) cannot sustain the complex reasoning loops required for autonomous runs, often leaving campaigns stuck in an “unknown” state.

Deployment Architecture and Enterprise Offerings

DarkMoon targets several technical roles across the security and development lifecycle:

• Security Teams: To run continuous, automated vulnerability assessments across internal infrastructure.
• DevSecOps Engineers: To integrate automated security testing directly into post-build CI/CD pipelines.
• Ethical Hackers: To automate target analysis and initial port-scanning during bug bounty campaigns.
• Security Researchers: To dynamically map and explore active attack surfaces.
• Educators: To teach offensive security concepts using reproducible environments.

Alongside the free open-source engine released under the GPL v3.0 license on GitHub, the project developers offer commercial tiers. These options include self-hosted, hardware-bound enterprise licenses, a managed “Pentest on Demand” service run by security specialists, and a reseller program tailored for managed service providers (MSPs).