ASC-IT launches Darkmoon for private AI pentesting

ASC-IT has released Darkmoon, an open source autonomous penetration testing platform, under the GPLv3 licence.

The Toulouse-based startup says the platform lets security teams use large language models in sensitive environments without exposing customer infrastructure data to external models. It replaces IP addresses, hostnames, credentials and network details with consistent placeholders before any information reaches the model.

As a result, the model sees tokens such as IP_PRIVATE_001 and HOST_INTERNAL_001 instead of the underlying values. The real data stays in a local vault and is restored only on the customer's machine immediately before a security tool runs, then masked again before output returns to the model.

Mehdi Boutayeb, Co-founder of ASC-IT, said data exposure had been the main obstacle to broader use of AI in offensive security.

"The blocker for AI in offensive security was never the reasoning, it was data exposure. The moment an autonomous agent sends a real internal IP to a hosted model, sensitive facts about a client's infrastructure leave their perimeter and land in a third party's logs. For a bank, a hospital or a defence contractor, that single fact rules the entire category out, no matter how good the tool is," Boutayeb said.

ASC-IT says deterministic placeholders let the agent track relationships across a target environment because the same real value always maps to the same token during a campaign. That allows the model to identify patterns such as host connections or reused credentials without seeing the actual data.

The startup also disclosed limits to the approach. Structural information can still be inferred because the number of items and how often they appear remain visible to the model, which it describes as a genuine information channel rather than something to dismiss.

"We would rather publish the limits than let someone find them. Deterministic placeholders leak structure. Cardinality and co occurrence stay visible to the model even when the values do not, and we treat that as a real information channel rather than pretend it away. The command gateway that blocks exfiltration is a policy layer, not a sandbox. And Juice Shop is a teaching application, so that number proves the gateway does not blind the agent. It is not a claim about hard targets," Boutayeb said.

Test results

To validate the design, ASC-IT ran Darkmoon against OWASP Juice Shop, a deliberately vulnerable training application, with the privacy gateway active throughout the exercise. According to the company, the platform identified 56 vulnerabilities without exposing any real IP address or email data to the model.

Beyond the privacy layer, Darkmoon uses a master agent that fingerprints a target, reviews 14 technology signals and assigns tasks to specialist sub-agents. Those agents can work in sequence or in parallel, while cascade depth is capped at three levels to avoid runaway recursion.

The system includes 18 specialised agents and can direct more than 80 security tools inside an isolated Docker container. Each command is handled through an MCP gateway, allowing a full campaign to be reconstructed command by command, ASC-IT says.

Broader scope

The platform covers web applications and APIs, Active Directory, Kubernetes, cloud infrastructure, content management systems and internal networks. Boutayeb said this distinguishes it from other open source AI testing tools, which he argued remain focused on the web layer.

"Active Directory and Kubernetes are where serious enterprise incidents actually happen, and that is precisely where the open source tooling stopped. We are security practitioners who moved into AI, not AI people who discovered security. We built what we needed on real engagements," Boutayeb said.

The reporting model is built around evidence rather than inference. Each finding includes the exact command used and the raw output, rather than a general suggestion that a weakness may exist, according to ASC-IT.

Methodology agents are written as Markdown playbooks, allowing teams to inspect, compare and edit the process used by the system. ASC-IT says the format is intended to help organisations explain how a finding was produced during an audit.

Darkmoon also supports reporting formats aligned with ISO 27001, HackerOne and Bugcrowd, alongside CVSS 3.1 scoring and MITRE ATT&CK mapping. ASC-IT is offering a free self-hosted Community edition with no gated features, while a paid Pro edition adds a hardened runtime, a managed web command centre, branded PDF export and hardware-bound licensing.

ASC-IT says the project's repository has passed 739 stars on GitHub. The company also holds Jeune Entreprise Innovante status in France, a designation for businesses whose audited spending is primarily directed towards research and development.