AI-driven pentesting agents: what they are and which tools self-host on VPS

A technical briefing published today on the Contabo blog clarifies a topic that has been circulating in security teams for the past few months: penetration testing conducted by agents based on large language models, rather than signature scanners or (solely) by human operators. For anyone running production servers, the practical question boils down to one thing: what do you run it on, and how much machine do you need?

What changes compared to a classic scanner

The workflow described by Contabo breaks down into four phases: reconnaissance of the exposed surface, scanning for known vulnerabilities, exploit simulation and report generation with reproduction steps. Unlike a traditional scanner, which follows fixed rules, an AI agent reasons about the target, chains together tools and attempts to exploit what it finds. The key difference from pattern-matching tools lies precisely here: a classic scanner flags a vulnerability as "possible" and leaves confirmation to a human; an LLM agent generates contextual payloads and, in more capable tools, produces a working proof-of-concept.

Contabo distinguishes this approach from security testing on the models themselves (prompt injection, data leakage, jailbreak)—a separate discipline concerning those who integrate an LLM into their own product, not those who use an LLM to test something else.

The open-source tools cited and self-hosting

Among projects highlighted as self-hostable via Docker is Strix, which on GitHub has surpassed 60,000 stars and is released under the Apache-2.0 licence: a Python package that runs on your own hardware against your own targets, with any model you choose. Alongside Strix, Contabo mentions PentestGPT as a copilot for manual testers, Nuclei with AI-generated templates for large-scale scanning, and OWASP ZAP as an established web scanner with AI add-ons coming soon.

How much VPS do you need?

For sizing, Contabo proposes two thresholds: the Cloud VPS 8 for tools that call a hosted LLM API (lightweight footprint), and stepping up to a Cloud VDS with dedicated vCores if reasoning runs on a local model, where RAM becomes the bottleneck. On the official pricelist, the Cloud VPS 8 offers 8 vCPU, 24 GB RAM and 300 GB SSD (or 150 GB NVMe), starting from €14.00 per month including VAT for the first 24 months (source: Contabo pricelist, checked 5 October 2026).

There remains the legal aspect, which Contabo states explicitly: testing must be conducted only on systems you own or with explicit written permission, regardless of whether a human or an agent materially launches the scan.