Reconix

A demo of example.com
The splash screen

Fully autonomous AI pentesting solutions have demonstrated severe risk. For example, AI agents being evaluated at OpenAI escaped containment and attacked Hugging Face this year. However, manual pentesting is slow and not scalable. Our goal was to find a middle ground: the power of agentic tooling while still enabling humans to have the final say. We were primarily inspired by AI-powered code editors, such as Cursor, Windsurf, and Claude Code, particularly in their ability to balance manual code review with the speed of agentic development.

Reconix is an AI-powered pentesting browser that is designed for human-agent collaboration. The AI acts as a copilot while you test: it maps the attack surface, spots likely vulnerabilities, suggests payloads, and drafts next steps. Anything dangerous or state-changing is paused and shown to you with context before it runs. Nothing executes until you approve it, and you get the speed of an agent without giving it unsolicited control.

We built it in Electron and TypeScript, and the shell splits into a sandboxed React renderer, responsible for the UI) while an isolated WebContentsView holds the webpages. These two interact via a narrow-typed IPC bridge, which prevents the target from interacting with the UI. We designed our development tools on the Chrome DevTools Protocol (CDP), adding request interceptions, repeaters, site crawlers, HAR support, and WebSocket captures. The AI on the side uses OpenCode as the agent runtime, where a lead orchestrator agent delegates to three subagents responsible for parsing, analyzing, and evaluating. Model inference is self-hosted through vLLM, which ensures no target data or prompts leave the local infrastructure.

Keeping the agent truly sandboxed was harder than we expected. Electron's defaults let too much leak across process boundaries, so we locked the renderer down (context isolation on, Node integration off) and sent every privileged action through a small, typed IPC bridge. The target page runs in its own WebContentsView, so it can never touch the UI or the agent directly. Human-in-the-loop approval was the next big problem. We had to draw a clear line between read-only recon, which is safe to run freely, and anything that changes state or could be destructive, which has to wait for a person. That meant going through every tool we exposed and tagging it, then building an approval queue that shows the operator the full picture (the request, the reason, and the expected effect) before anything runs. Self-hosting inference with vLLM added a lot of operational weight too. Model loading, context-window limits, and cold-start latency all gave us trouble, especially once the multi-agent orchestration was running.

We found a middle ground between fully autonomous and fully manual pentesting. The agent moves at machine speed on recon and analysis, but nothing dangerous happens unless a human says yes. The CDP tooling is a real toolkit, not just a demo: request interception, a repeater, a site crawler, HAR support, and WebSocket capture. And since inference runs locally on vLLM, no target data or prompts ever leave the operator's own infrastructure, which matters a lot on sensitive engagements. Approval friction is a design problem, not just a safety switch. If you gate too much, the agent is useless. If you gate too little, you've built exactly what you were trying to avoid. Tagging tools by blast radius (read vs. state-changing) was the idea that made it work. We also learned how much process isolation Electron needs before a browser aimed at hostile targets can actually be trusted, and how much latency and context budgeting limit what a locally hosted multi-agent pipeline can realistically do.

Our goals for the future are as follows:

Expand the CDP toolset and add replayable, exportable engagement sessions
Smarter approval batching, so groups of low-risk actions can clear in one decision without weakening the gate
Tune the orchestrator/subagent split and context budgets to cut latency
Richer evidence collection and report export for handing off to clients
Harden the sandbox further and support more targets

Thank you for reading!