Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
OIHK is a software-based, early-beta penetration-testing engine built around a stricter rule than “the model says it found a bug”: a suspected vulnerability is not treated as a finding unless a governed tool execution succeeds, an execution record exists, and a separate validation step confirms it. That workflow—not a guarantee of security coverage—is what its developer means by saying it is not just an LLM connected to a shell.
What OIHK is—and what it is not
OIHK is an open-source, local multi-agent AI penetration-testing engine developed by Broskidev. The project’s repository identifies it as early beta and licenses it under MIT. It is software, not a physical pentesting device, and its documentation frames it for authorized assessments. The project README is the current source for its stated features and requirements; the developer’s launch article explains the design motivation.
The author’s criticism of a simpler “GPT wrapper” pattern is specific: a single model in a loop with shell access can produce a convincing vulnerability report or proof-of-concept string without demonstrating that the issue exists. OIHK’s proposed answer is architectural skepticism—treat the model’s suspicion as a lead, not evidence.
Recommended Free Tools
How its multi-agent workflow is intended to work
Rather than using one model for every task, OIHK describes a root planner coordinating specialists. The launch article names reconnaissance, discovery, validation, and reporting; the current README also describes attack and privilege-escalation roles. These are project-described roles, not an independently verified account of every run.
#1 Best Overall
A shared plan and evidence trail
Agents work from a versioned scan plan with revision history and resume support. The project also describes an evidence ledger containing immutable execution records. The root planner is not supposed to close a run while critical work remains open. Together, these mechanisms are meant to make it possible to trace what the agents planned and what actually ran, rather than relying only on the final narrative.
Discovery is not validation
A specialist may identify a possible issue, but OIHK’s stated rule requires a successful, governed tool execution, a recorded execution, and separate validation before it becomes a finding. As Broskidev puts it, “An LLM writing a convincing PoC string is not a finding.” The author also describes the principle as “no evidence, no finding.” Those phrases explain the intended design; they do not independently establish that every run will correctly detect, validate, or report vulnerabilities.
Rank #2
What the project says about safety and scope
The project describes policy controls for operating mode and agent role, exact target scope, resource governance, and sandbox egress. Its launch article gives more implementation detail: passive mode is intended to reject active tools even when invoked through a generic shell; declared hosts are resolved once and DNS-pinned; and network egress is restricted through a netfilter allowlist in a per-run namespace. It also says the engine aborts startup on platforms where isolation cannot be guaranteed, and describes a read-only root filesystem, dropped capabilities, no-new-privileges, non-root operation, and no sudo surface. These are the developer’s claims about the system, not the findings of an independent security audit.
The README places important duties on the operator: obtain authorization, set safe limits, protect target availability, handle data appropriately, and comply with applicable law. Scope and sandbox controls do not themselves authorize a test or eliminate the risk of a misconfigured assessment. Use the software only against systems you are permitted to test, and understand the target and operational consequences before running active checks.
Rank #3
What its evaluation numbers do—and do not—show
The project’s published scenario count differs between its launch article and current repository README. The launch article, published August 27, 2026, describes 16 deliberately vulnerable local scenarios. The current mutable README lists 24 bundled scenarios spanning areas such as web applications, APIs, authentication, source code, and configuration. These are figures from different project-authored materials, not a single independently verified benchmark set.
| Project statement | What it refers to | How to interpret it |
|---|---|---|
| 16 scenarios | The developer’s August 27, 2026 launch article | A launch-era count of local deliberately vulnerable scenarios. |
| 24 scenarios | The current project README | The README’s later, broader bundled scenario count; the repository can change over time. |
| 24/24, 100/100 | The current README’s deterministic mock solver | A result for the mock solver on the project’s stated set, not a general external model result or an independent effectiveness study. |
The launch article says the evaluation exercises the real engine and scores the model programmatically rather than asking a model to grade itself. That describes the project’s evaluation method, but the available figures do not establish a third-party comparison, a general success rate against real targets, production adoption, or a track record replacing human testers.
Models, platforms, and stated requirements
OIHK presents itself as model-agnostic at the interface level: it accepts OpenAI-compatible endpoints, defaults to LM Studio for local inference, and supports routing different roles to different models. The README also lists cloud-provider presets. “Swap the model, keep the engine” captures the separation the project aims for, but compatibility at the endpoint level does not establish that every model performs equally well or that every configuration has the same privacy properties.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The current README states the following requirements and compatibility status. These are project-published specifications, not independent compatibility testing:
- Windows 10 or 11, or Linux; Kali is listed as tested. macOS is marked untested.
- Python 3.12 or later and Docker for scan sandboxing.
- 8 GB RAM minimum and 16 GB recommended.
- OIHK itself does not require a GPU. A locally selected model has its own hardware and memory requirements.
For the most current requirements, consult the README, since repository documentation may change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Who should consider it—and what remains uncertain
OIHK is most relevant to security practitioners who want to examine an agentic testing workflow in which tool execution and validation are explicitly separated from model-generated claims. Its plan revisions and execution ledger also address a practical problem in autonomous systems: making the path from a hypothesis to a reported result more inspectable.
Its early-beta status matters. The project’s controls and evaluation are developer-reported, and the sources cited here do not establish independent resistance to attack or misconfiguration, comparative effectiveness, or production readiness. It should be treated as an experimental tool requiring knowledgeable supervision—not as a substitute for a qualified human penetration tester or a basis for declaring a system secure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
