This approach is actually implemented in Strix, a recently trending open-source framework (17.4k stars) for AI pentesting agent. The framework spins up a team of AI "attackers" that probe your web apps, APIs, and code.
It then returns validated findings with exploit evidence, remediation steps, and a full PDF report that looks exactly like what you'd get from a traditional firm, but without a $50k invoice and a month-long wait time.
You can see the full implementation on GitHub and try it yourself. Just run: strix --target https: //your-app .com and you are good to go.
Human red teams aren't disappearing, but the routine pentest (pre-launch, post-refactor, quarterly checks) is clearly shifting to AI.
Open-source! ❤️