Give Your AI Security Agent a Kali VM

A security agent needs somewhere to work: run Nmap, inspect an executable, save evidence, and try another approach without losing the investigation.

Kali Linux 2026.3 is now available on Freestyle as freestyle/kali. Give your agent a Kali VM with security tools installed, connect it to the targets it needs, and snapshot its progress before the next experiment.

import { Freestyle } from "freestyle";

const freestyle = new Freestyle();
const { vm } = await freestyle.vms.create({
  snapshotId: "freestyle/kali",
  firewall: { rules: [] },
  maxRunSeconds: 3600,
});

const result = await vm.exec({
  command: "nmap --version && r2 -v",
  linuxUser: "kali",
});
console.log(result.stdout);

The snapshot includes 4 vCPUs, 8 GiB of memory, and 32 GB of disk. Nmap, sqlmap, Metasploit, radare2, binutils, Python, and OpenSSH are included. Drive the tools through your agent's shell interface, or connect over SSH to inspect the work yourself.

The VM in this example starts with no requested network access rules. Add access to the application being assessed. For local binary analysis, you can leave public egress disabled. The one-hour running budget pauses the VM rather than deleting the work.

Pentesting: make the finding reproducible

The hard part of an AI pentesting workflow is turning a suspicion into something another engineer can verify.

Give the agent an assessment brief: the objective, exact targets, available test identities, request budget, and expected permission boundaries. Connect its Kali VM to your staging application over a private VPC, or grant access to the specific external destinations it needs.

Then let the agent investigate one question at a time. Can one tenant download another tenant's export? Does a user-controlled path escape its intended directory? Does the deployed configuration actually meet the conditions for a reported component vulnerability?

A useful agent establishes normal behavior, changes one variable, and retains the request and response that demonstrate the difference. Scanners help investigate a hypothesis. A scanner result alone is not the finished finding.

Our pentesting guide gives agents a practical workflow for real assessments: target setup, bounded discovery commands, choosing tools, preserving evidence, reducing false positives, and verifying repairs with both the original reproduction and normal control requests. It includes instructions you can give directly to an agent.

Reverse engineering: branch the hypothesis

Reverse engineering benefits from the same discipline. Start with an artifact and a question. Preserve its original bytes and hash. Establish its format, architecture, sections, imports, and relevant strings before deciding where to look next.

The agent can use radare2 and binutils to follow a parser, reconstruct a validation routine, or explain a configuration path. Keep a record of addresses, cross-references, assumptions, and the observations that support or contradict each explanation.

When the next question requires executing or changing the binary, branch from a checkpoint:

const { snapshotId } = await vm.snapshot({
  displayName: "Analysis checkpoint",
});
const { vm: experiment } = await freestyle.vms.create({
  snapshotId,
  firewall: { rules: [] },
  maxRunSeconds: 3600,
});

Now the agent can test a patch or a different analysis strategy in an independent VM. Keep a control run against the original. Compare the same inputs, outputs, exit statuses, and artifact hashes.

Our reverse-engineering guide covers that workflow, from sample intake and static triage through bounded execution, patch records, and an evidence-based handoff. It distinguishes inferred behavior from behavior the agent has actually demonstrated.

Keep the investigation alive

Freestyle snapshots preserve memory and disk: working files, notes, installed tools, and running processes. Pause a VM between sessions and resume it when the agent or a human is ready to continue. Branch before experiments that would interfere with one another.

Be precise about what is preserved. A snapshot of the Kali workbench does not rewind a remote application or database. For repeatable application tests, checkpoint the target too or use its own fixture and reset mechanisms.

Kali on Freestyle is a strong fit for AI agents doing pentesting and reverse engineering because the agent gets established tools in a persistent workspace, explicit networking, and independent branches for experiments. The result should be an investigation another agent or engineer can pick up and verify.

Start with the pentesting workflow, the reverse-engineering workflow, or the base snapshot reference. For the broader motivation, read AI Security Agents Need a Lab They Can Break.