I ran an AI pentest on my homelab. It found almost nothing

I spent three days this week running an AI pentesting agent against my own homelab, "everything reachable" scope, which turned out to be 38 targets. Strix is the tool, open source, agentic exploit + PoC validation, and I ran it with a local model instead of the cloud frontier models the docs push. Figured I'd share the numbers, including the one I did not expect: 35 of 38 targets came back with zero findings, and the findings that did land came exclusively from runs I killed, never from runs that finished.

System

• Qwen3.8-Flash-Next (38B MoE, NVFP4) on a DGX Spark, served through my LLM gateway as the scan brain
• Strix v1.6.2, quick mode, READ-ONLY instruction ("do not modify, delete, damage or DoS anything; validate with minimal reversible requests")
• 38 targets: 5 app source repos, 4 public endpoints, 13 LAN web apps, 8 infrastructure/gateway IPs, 2 monitoring dashboards
• No turn cap, 2-3h wall budget per target, 4 scans in parallel

Round one: scope drama First dispatch was 14 hand-picked targets. That got rejected within a few hours — the expectation was the full reachable surface, not a curated subset. Killed round one, rebuilt the list from the wiki's inventory snapshot, and live-probed every candidate with /dev/tcp before writing the targets file. That step killed 5 dead entries before they polluted the run and caught a split-horizon DNS leak where 3 LAN hostnames resolved to my public IP instead of the internal box. Cheap step, worth doing before every sweep.

Round two: serial was unusable I had the L1 agent act as scheduler, spawning one scan at a time. One target per hour. At that rate the remaining 31 targets would take roughly 28 hours. Killed it the next morning: 7 targets done overnight.

Round three: a parallel driver Wrote a small parallel driver instead. Four workers, each atomically claims the next undone target via lock files, runs Strix with the READ-ONLY instruction, appends a findings block, marks the target done. Crash-resumable, so a dead worker never re-scans finished work. It chewed through the remaining targets in about a day and a half.

The numbers

The 19 findings on the LAN/public side break down as mostly "no issue identified" coverage items with a few real leads: unauthenticated GET /api/revalidate on my homepage (cache manipulation), open self-registration plus exposed swagger on homebox, and on the attachments tool a reachable PocketBase admin UI plus an OAuth credential-disclosure endpoint that returns 200. All worth fixing regardless of what the tool says.

The part that annoyed me: every one of those 19 findings came from an interrupted run. The scans that completed cleanly found nothing, every time. Deep scans burned 5M+ tokens on recon spirals and hit the 2-3h wall with nothing to show. The runs that produced anything were the ones my own tooling killed mid-flight. The forum wisdom of "just give it more turns, it'll converge" is wrong on this model. I gave it unlimited turns and 3 hours. It does not converge.

The infra casualties Running 12+ concurrent agent loops on a 16GB orchestrator box: swap at 100%, OOM kill, orphaned Strix children that survived the kill because the binary is a PyInstaller onefile (the inner app keeps running while the bootloader dies), sandbox containers holding 1.5-1.7G of writable layer each until I reaped them. At 6 parallel scans the inference engine's KV cache saturated at 83% and decode collapsed to 2-5 tok/s; the fix was an engine restart, because vLLM has no cache-clear endpoint. The gateway started 502ing on the giant re-sent contexts. None of that was the engine's fault — the scans just grow hundreds of thousands of tokens of conversation per target.

Where I land On this local model, Strix is a recon tool, not a vulnerability detector. It maps the surface, enumerates endpoints, and writes coverage reports, and it can't tell you which of those endpoints is actually exploitable. The numbers make it concrete: 5M+ tokens and up to 3 hours per deep target, zero completed scans with findings.

For real depth on internet-facing targets the honest cost is a frontier model at roughly $0.5-2 per scan, which I deliberately skipped because I wanted the local baseline first. This was the baseline. If you've run Strix (or similar agentic pentest tools) with a local model and gotten actual findings out of it, I'm curious what model and what target profile you used — happy to rerun the sweep with a different brain and post the diff.