VinceOvando
LLMitM v2 is an autonomous pentesting agent where Opus 4.6 builds the automation that replaces itself.
Core trick
Captures HTTP traffic with mitmproxy, has the LLM compile its reasoning into a stored Neo4j action graph that replays with zero LLM calls.
Description
LLMitM v2 is an autonomous pentesting agent where Opus 4.6 builds the automation that replaces itself.
Penetration testing is locked behind years of expertise and expensive tooling. LLMitM v2 breaks that barrier: it utilizes Anthropic's frontier models to capture HTTP traffic from a target web application and reason about where business assumptions and code behavior diverge — the methodology senior pentesters use intuitively — then compiles that reasoning into a deterministic ActionGraph stored in Neo4j. The first engagement requires Opus 4.6's reasoning. Every subsequent engagement against a matching target executes with zero LLM calls.
When a stored graph breaks, the system classifies the failure, Opus 4.6 recompiles only the affected portion, and the fix is stored permanently — reused at zero cost on the next run. Opus 4.6 made this possible: a self-repairing agentic system that bridges natural language interpretation and programmatic automation.
README excerpt
# LLMitM v2 Autonomous pentesting agent that compiles LLM reasoning into reusable, deterministic exploit graphs. Built for the [Claude Code Hackathon](https://cerebralvalley.ai/e/claude-code-hackathon) (Feb 10–16, 2026). LLMitM v2 discovers web application vulnerabilities by reasoning about where business intent and code behavior diverge. It captures HTTP traffic via mitmproxy, identifies a target's technology stack and authentication model, and builds reusable test sequences that probe for flaws like IDOR, authentication bypass, and privilege escalation. Verified end-to-end against three real vulnerable web applications — OWASP Juice Shop (bearer token), NodeGoat (session cookie), and DVWA (cookie + CSRF) — across four modes: cold start, warm start, self-repair, and persistence. ## Core Thesis **The LLM builds the automation that replaces itself.** Expensive LLM reasoning happens once at "compile time" to produce an ActionGraph — a validated, deterministic sequence of CAMRO steps (Capture, Analyze, Mutate, Replay, Observe) stored in Neo4j. The system executes that compiled artifact repeatedly without any LLM involvement. As the graph accumulates knowledge from each engagement, the system converges toward zero LLM cost. First engagement is expensive. Second is free. Hundredth is still free. This inverts the economics of every other AI-assisted security tool. Most systems use the LLM as a runtime — every action requires a model call, costs scale linearly, and knowledge