Netwalker: AI Pentest Agent Running on MAYASEVEN's Own GPUs

Netwalker: MAYASEVEN's AI pentest agent, running on our own GPUs

Netwalker is the AI penetration-testing agent MAYASEVEN built in-house. It runs on local LLMs on hardware we own and uses no third-party model APIs. Netwalker sweeps the attack surface at machine speed; our experts prove, chain and sign off every finding before it reaches your report. Launched on 24 September 2026.

An AI that works like a pentester, with an expert checking every finding

Netwalker is MAYASEVEN's AI pentest agent and a standard tool in our penetration-testing engagements. AI alone is fast but often wrong; human experts alone run out of time. So we run them together. Netwalker enumerates and tests the full attack surface exhaustively, and our experts prove what is real. You get speed and certainty in the same report.

Testing modes: white box, black box and gray box
Targets: web applications, mobile applications and integration testing
Launch demo: on a sample e-commerce site, Netwalker found more than 30 vulnerabilities in under 10 minutes

Pentester, Netwalker and target work in a loop

Pentester: sets the scope, assigns tasks to the agent and reviews every result before it goes to the client
Netwalker: the harness drives the work and the local model does the reasoning, in rounds of plan → act → verify
Target: the client's systems, strictly within the approved scope

Netwalker architecture: the pentester assigns work, the agent plans, acts and verifies against the target

The harness: what makes a model work like a professional pentester

Enforces scope and guardrails, and touches nothing outside the approved targets
Connects the model to real tools for recon, exploitation and post-exploitation
Loops plan, act and verify until a vulnerability is proven
Logs every command and keeps the evidence for later review
Picks the right model for each task and manages context and tokens

The model layer starts from DeepSeek v4.1 Flash and GLM 5.3 Flash, further developed into MAYASEVEN's own models alongside other local models. All of it runs on GPUs we own, and we hold the model weights.

AI you can measure, machine-graded

We test Netwalker the way AI labs test their own models: machine-graded against exact answers. There are two suites, one for exploitation and one for code reading. Clients can choose the vulnerabilities to test themselves, and we share every graded run.

Suite 1: exploit 104 targets, get the flag or score zero

A public set of 104 challenges. The agent must capture the exact flag or it scores zero; there is no partial credit.

104 challenges (same method)	MAYASEVEN on our hardware	Published frontier cloud models
Black box (no source code)	101/104 (97%)	Claude Opus 4.5: 97 · GPT-5.5: 96
White box (source code provided)	103/104 (99%)	No like-for-like result published
Principal pentester (reference)	—	about 85%

Suite 2: 255 real vulnerabilities the model has never seen, 238 found

A benchmark means nothing if the model has already read the answers. So we use only real CVEs published after the model's training cutoff, and add new ones every month. We ran all 255, with no sampling.

Found and correctly classified 238/255 (93%), compared with about 9% for a typical code scanner
100% in 3 of 8 classes: command injection (16/16), deserialization (14/14) and XXE (5/5)
By language: JavaScript 45/45 · PHP 43/45 · Java 42/45 · Python 42/45 · Go 39/45 · Ruby 27/30
Drawn from 167 real projects such as Rails, Hugo, Ghost, Gitea, Mattermost, Apache Camel, Open WebUI and LiteLLM (CVEs from January to September 2026)

Benchmark table: 255 new CVEs, 238 found

The same code-reading precision powers our source code review and white-box testing.

Models on our own hardware, no third-party model APIs

The system holding your unpatched critical vulnerabilities is one of the most sensitive things your organisation will ever approve. Most AI security tools send that data to a model provider abroad, where you can neither see nor control it.

Netwalker's models run on hardware we own, inside an ISO/IEC 27001-certified network in Thailand. No data is sent to OpenAI, Anthropic or Google. That also cuts the paperwork on your side: no cross-border data transfer review, no cloud outsourcing filing, and no new AI vendor for your regulator to assess.

In three months Netwalker processed 193.1 billion tokens across 2.02 million requests with a 98.1% success rate, all on our own GPUs.

Sovereign by design: models run on MAYASEVEN GPUs in Thailand

Every finding proven, every report signed by an expert

No invented findings: a finding counts only if it appears in a real, recorded response from your system. The agent can report only what the target actually returned.
Reproducible: every item comes with a step-by-step proof of concept and a fix, so your team can act on it immediately.
Accountable: every report is signed by a certified expert (for example OSCP, OSCE and eWPTX). The machine never signs.

Netwalker is used in MAYASEVEN's penetration testing and source code review. Our team operates it inside the engagement you commission; there is nothing for you to install or run.

FAQ — Netwalker

What is Netwalker?

Netwalker is the AI pentest agent MAYASEVEN built in-house. It runs on local LLMs on GPUs we own. MAYASEVEN's experts use it in penetration tests to enumerate and test the attack surface at machine speed, then verify every finding before reporting. It launched on 24 September 2026.

Which AI models does Netwalker use?

The model layer starts from DeepSeek v4.1 Flash and GLM 5.3 Flash, further developed into MAYASEVEN's own models alongside other local models. All of it runs on GPUs we own, and we hold the model weights.

Is our vulnerability data sent to a foreign AI provider?

No. Netwalker's models run on MAYASEVEN hardware inside an ISO/IEC 27001-certified network in Thailand. No third-party model APIs are used, and no data is sent to OpenAI, Anthropic or Google.

Will the AI report vulnerabilities that don't exist?

A finding counts only if it appears in a real, recorded response from your system, and our experts re-verify every item with a reproducible proof of concept. Every report is signed by an expert, never by the machine.

Can Netwalker test outside the agreed scope?

Netwalker's harness enforces scope and guardrails so it tests only approved targets, and it logs every command for later review. Our testers agree the scope, depth and constraints with you before work starts and stay in control throughout.

Do clients need to install or operate Netwalker?

No. MAYASEVEN's team operates Netwalker inside the penetration test you commission, and you receive an expert-verified report. In 2026, clients who engage MAYASEVEN for a pentest get Netwalker's additional vulnerability discovery at no extra charge.

How reliable are Netwalker's benchmarks?

Every suite is machine-graded against exact answers. The CVE suite uses only real vulnerabilities published after the model's training cutoff, and all 255 were run with no sampling. Clients can choose the vulnerabilities to test, and we share every graded run.