PWNPWL

LLM-driven red-team orchestration. Multi-role AI that argues with itself about whether it actually proved anything.

_

WHAT

Autonomous pentesting with a built-in trust problem.

PwnPwl orchestrates the whole pentest across as many targets as you point it at. Different roles own different decisions, what to attack next, whether an exploit actually worked, when to give up and move on. The role that ran the command never gets to call it a finding; validation happens blind, with nothing but the tool input and raw output. Protective policies gate every shell interaction, and every verdict traces back to the output that produced it.

HOW

Strategist
Owns the plan. Breaks objectives into goal contracts, rewrites the approach after vetoes, and calls bullshit on completion claims. Deliberately runs a different model than the Actor.
Critic
Doesn't trust the Actor's world model. Audits against raw tool output, vetoes weak halts, and steps in when roles disagree. Has a veto budget so it can't stall things indefinitely.
Supervisor
Validates findings blind. Never sees the Actor's reasoning, just tool input and raw output. Can downgrade confidence but can't delete findings. Goes back and re-examines old findings when new evidence shows up.
Researcher
Quiet recon without running noisy tools. Called when the Actor needs exploit feasibility, service fingerprinting, or CVE context. Also catches repeated tool failures and pulls the actual man page instead of letting the Actor keep guessing.
Actor
Has shell or tool access. Picks attacks, runs tools, reads output. Gets a fresh view of campaign state every round instead of an ever-growing transcript.
WHY
separate models, separate context The roles don't share a context window. The Supervisor never sees why the Actor thought something worked. Disagreement is structural, not performative. state from the database Every round starts from a fresh materialized view. Nothing carries over in the transcript. The model can't hallucinate history that didn't happen. guards are code Scope enforcement, brute-force limits, and destructive-action checks run before the model touches the shell. They're not suggestions in a system prompt. findings validated blind The role that ran the exploit doesn't get to certify it. A separate role sees tool input and raw output, nothing else, and decides whether it holds up. full provenance Every verdict traces back through finding, action, and raw shell output. If someone asks "how did you get root," the answer is a chain of evidence, not a summary.
CONTACT

In active development. Not publicly released yet, but access may be granted on request. If you just want to ask questions or talk about the project, same address.

info@pwnpwl.com