A new penetration testing framework claims it can run an entire security engagement without ever touching a paid API.
PentestChain is a ten-phase automated pentesting system built by academic researchers, pairing a fixed, deterministic exploit map with a tiered AI fallback chain. A local 7-billion-parameter model, qwen2.5-7b run through Ollama, tries first; if it stalls, the system escalates to free tiers of OpenRouter and Cerebras, with a rule-based fallback that always returns an answer. The whole pipeline is exposed through eleven tools on a Model Context Protocol (MCP) server. Tested against legacy targets, it detected 26 services and enriched data on 34 CVEs while running at zero measured paid-API cost.
Earlier pentesting-AI research leaned on frontier models like GPT-4, and the per-engagement token bill put continuous automated testing out of reach for the smaller organizations that need it most. The researchers also treat the MCP server itself as an attack surface worth worrying about, grounding their threat model in real 2025 incidents: the CVE-2025-6514 remote-code-execution flaw in mcp-remote and the postmark-mcp supply-chain backdoor.
Zero measured paid-API cost is not the same as zero cost - someone still has to run and secure that local model, and handing a 7-billion-parameter model the keys to an offensive toolchain is its own experiment worth watching closely.