The autonomous AI pentester that proves every exploit.
Basilisk is an open-source, autonomous AI penetration-testing agent — a native Linux desktop app that turns any large language model into a working penetration tester. On the OWASP Juice Shop benchmark it scores 87 of 113, fully autonomous and black-box — running on DeepSeek-V4-Flash, one of the cheapest models available — beating Cascade (36) and a bare Claude Opus 4.8 (23) on the same board, including their white-box runs — and 22 of 22 on Escape's contamination-free Duck Store API benchmark. It runs entirely on your own machine, brings your own model key, and is MIT-licensed. It doesn't guess — it confirms.
Why it beats bare models: most autonomous "AI pentesters" ask the model whether a bug worked and record its answer, so findings drift and scores collapse on unseen targets. Basilisk arms every exploit with the marker that would prove it — a dumped row, another user's token, an out-of-band callback — fires, then checks against ground truth before it counts. No proof, no finding.
Basilisk executes real exploits and real shell commands against whatever you point it at, on its own, with your user's privileges. In Unleash mode it confirms the target and then runs with no per-step approval and does not stop until the objective is met — aimed at the wrong host it will keep attacking it until you pull it off. Run it only against systems you own or have explicit written authorization to test; unauthorized testing is a crime in most jurisdictions. The irreversible-command class — disk wipes, recursive root deletes, fork bombs, raw block-device writes — is hard-blocked in two independent places and has no "run anyway"; everything else it will do if you tell it to. Point it carefully.
A GTK4 desktop app that gives a language model hands.
Point it at an authorized target and it runs the engagement end to end — recon, exploitation across every web-vulnerability class, verification, and a reproducible write-up — turn after turn, on its own, until the objective is confirmed or you press Stop. One tap of Unleash and it confirms the target out loud, then drives the whole engagement off the leash — no per-step approval, no stopping until the mission is verifiably done. It also audits your own code across ten scanners, hardens a host, and drives your shell and desktop.
The claim is only worth the number you can regenerate.
Basilisk is scored against OWASP Juice Shop, which marks a challenge solved only when the exploit genuinely fires — no partial credit, no checklist to recall, graded by difficulty from one to six stars. It's the comparable benchmark the security community already uses.
The curve is the honest part: it now clears the entire lower half — every one- and two-star, and 24 of 26 three-star — then thins as the chains get deeper, the shape a real tool should have. It still takes 7 of 12 six-star challenges (SSRF, SSTi, Forged Coupon, Forged Signed JWT, Login Support Team, Premium Paywall, Arbitrary File Write) and 13 of 19 five-star. Misses cluster where one builder isn't enough and the chain runs long — RCE/DoS variants, NoSQL manipulation, and the LLM-chatbot challenges.
| Agent | Black-box | White-box (source given) |
|---|---|---|
| Basilisk v7.6.0 | 87 / 113 | — |
| Basilisk v7.5.3 | 81 / 113 | — |
| Basilisk v7.1.0 | 73 / 113 | — |
| Basilisk v6.0.0 | 58 / 113 | — |
| Cascade (Windsurf) | 36 / 113 | 49 / 113 |
| Claude Opus 4.8 | 23 / 113 | 24 / 113 |
Published work generally puts fully-autonomous LLM pentest agents around 20–30% on comparable tasks. Basilisk clears roughly 77% on the full board, black-box — well above that line, and on one of the cheapest models on the market at that.
Every number here was produced by Basilisk driving DeepSeek-V4-Flash — a cheap, fast model, not a frontier one. The same board, run by Cascade and by a bare Claude Opus 4.8 on their own pricier models, scored 36 and 23. The result isn't the model — it's the verified-exploitation loop wrapped around it: give a budget model the right scaffolding and it beats agents costing many times more.
Escape's Duck Store — a deliberately-vulnerable REST API.
A different shape of target from Juice Shop: the planted flaws are API-first — broken object- and function-level authorization, mass-assignment privilege escalation, server-side request forgery, and business-logic abuse. Basilisk found every one working purely from the live API surface, no schema handed to it.
Don't take the number. Regenerate it.
Stand up the same container, point Basilisk at the board, and call juiceshop_report — it reads the live scoreboard at /api/Challenges and reports solved and available by difficulty. Score any other tool against the same container and compare.
# spin up the graded target, then aim Basilisk at it
docker run -d -p 3000:3000 -e NODE_ENV=unsafe \
--name juiceshop bkimminich/juice-shop
A closed loop, not a payload spray.
Basilisk reads a target's behaviour to identify the vulnerability class, reaches for the matching exploit builder, fires it, and confirms the hit against ground truth before moving on. Every attempt and verdict lands in an exploitation oracle — so the loop never re-runs a solved bug and gets sharper about what's left.
Read the behaviour
Fingerprint the stack and watch how the target responds — reflections, timing, error shapes — to name the vulnerability class.
Match a builder
Reach for the general-purpose exploit generator for that class, parameterised for this target — not a Juice-Shop-bound toy.
Arm the proof
Bind the marker that would prove the bug: a dumped row, a foreign token, a status, a measurable difference, an OOB callback.
Fire
Send the payload through the same gate every command passes — with the destructive class hard-blocked underneath it.
Check ground truth
Look for the armed marker in the response. A 200 or a plausible-looking body is not a solve; only the marker is.
Record the verdict
Write confirmed / failed / pending into a ledger it consults every planning turn, hashing the command as it goes.
Exploit builders
Four subsystems bridge a CTF and a real host
Parses a JSON or XML body, injects at every node, and serialises back to valid syntax — so the payload actually reaches each field instead of breaking the parser.
Extracts every dynamic token from a response — cookies, CSRF, bearer/JWT, nonces — and threads it into the next request, reaching steps a stateless scanner never gets to.
Proves blind bugs by measuring: diffs TRUE vs FALSE responses for a boolean channel, and analyses latency statistically (mean, stddev, z-score) to confirm time-based blind past network jitter.
Arms, fires, and checks — recording confirmed / failed / pending in a ledger. For blind bugs that echo nothing back it stands up a local out-of-band canary listener: the payload carries a unique callback URL, and a hit proves the bug with certainty. Runs locally and offline.
It remembers, it learns, and it writes its own tools.
Basilisk is not a stateless prompt. It carries persistent memory across sessions, sharpens itself inside an engagement, and can extend its own toolset when something is missing — all on your machine, all under your control.
Persistent memory across sessions
Facts, preferences, past fixes, and prior findings persist in a local SQLite store you own. Recall is relevance-scoped: each turn pulls only the handful of memories most relevant to the current task, so history can grow indefinitely without ever bloating the context window or the token bill. It's keyword-based by default — zero model compute, fast enough to run on a phone — and upgrades to embedding similarity when a model provides it. One settings toggle, one memory_forget tool, and nothing leaves the box.
Learns within the engagement
Every attempt and verdict lands in the exploitation oracle. Confirmed bugs are never re-run and dead ends aren't retried, so the longer Basilisk works a target the sharper its next move gets — it spends its turns on what isn't proven yet. When an approach stalls, it pulls the exact technique from a vetted source and applies it on the following move instead of flailing.
Writes and keeps its own tools
When the toolbox is missing something, Basilisk can write a new Python tool, test it, and keep it — but only if it passes. A proposed skill runs nothing until you click Apply; then it's parsed, run against its own test in the sandbox, and saved only if that test succeeds. A tool that can't prove it works is never kept. Every later call runs in the sandbox too, and unused skills are archived rather than deleted.
Remove the doors rather than bolt on a filter.
An agent that reads the outside world and runs shell commands is a prompt-injection target. Basilisk is built so a compromised model still can't do the things that matter.
Injection surface removed, then gated
Tools that fetched attacker-chosen URLs are gone. What's left reads only from a fixed allow-list, split in code: trusted advisories (NVD, MITRE, CISA) fetch automatically; user-authored sources (GitHub, exploit-db) are held outside the loop behind a one-tap approval. Off-list URLs, redirects, and cloud-metadata addresses are refused.
The irreversible class can't run — twice
A structural detector hard-blocks disk wipes, recursive root/$HOME deletes, fork bombs, and raw block-device writes — seeing through quoting, $IFS, and bash -c tricks a regex misses. Refused at the UI gate and inside the execution primitive. There is no "Run anyway."
Untrusted input is quarantined
Anything from outside — a target's response, an MCP result, an analysed image — passes a deterministic content firewall and is wrapped as data, never instructions before the model ever sees it.
Your sudo password never touches the model
Self-written code runs only in a bubblewrap jail after passing its own test, and Basilisk's own safety code can't be overwritten by a shell command. It writes real exploits for authorised targets — but it won't produce standalone weaponised malware, and all of it is pinned in the test suite.
You supply the brain. Keys stay on your disk.
Multi-provider — you only need a key for the one you want, set in Settings → Backends. Keys live only in ~/.config/basilisk/settings.json, locked to your user; they go nowhere but the provider's own API.
Large open models — DeepSeek, Qwen, Kimi — plus SenseVoice speech-to-text.
Get a key →Read the installer. Then run it.
Basilisk runs shell commands as you — so it ships as plain Python plus one shell script you can read start to finish. The installer auto-detects your distro, parse-checks every file before it touches disk, and backs up your chat history. The same command updates in place.
curl -fsSL https://raw.githubusercontent.com/the-priest/PriestsBasilisk/main/install.sh | bash
git clone https://github.com/the-priest/PriestsBasilisk.git basilisk
cd basilisk
less install.sh # read it first
./install.sh
- Python 3.10+, Linux with GTK4 / libadwaita (X11 or Wayland).
- Runs on desktop Kali and on NetHunter Pro (Phosh/Wayland) on a phone.
- Standard tooling (nmap, sqlmap, …) is auto-detected; missing tools are flagged with an install hint, never assumed.
Straight answers.
Common questions about Basilisk as an AI penetration-testing agent — how it compares, what it runs on, and whether it's safe.