Pentesting by Chat, Held Together by Seven Mandatory Accounts

What it does HackerAI is a Next.js chat application pitched as an AI-powered penetration testing assistant. It connects to OpenRouter for language models, E2B for sandboxed code execution, and Trigger.dev for background agent loops. The README claims you can “find and fix vulnerabilities by chatting with AI,” but it offers almost no detail on how the agent actually identifies or exploits security flaws.

The interesting bit The real work here is integration architecture: the project stitches together Convex, WorkOS, Trigger.dev, E2B, and OpenRouter to create a managed environment where an agent can execute code safely and resume interrupted streams. That stack suggests the authors are more concerned with reliable, sandboxed agent execution than with building yet another generic chat wrapper.

Key highlights

• Runs agent tasks on Trigger.dev with durable execution and optional Redis-based stream resumption
• Sandboxes code execution through E2B rather than running it on the host
• Routes AI requests through OpenRouter, keeping model providers interchangeable
• Layers OpenAI content moderation on top of the primary inference pipeline
• Apache 2.0 license with explicit commercial restrictions

Caveats

• The README is almost entirely setup instructions; actual pentesting capabilities and methodology are vague
• Requires accounts with at least six external services (OpenRouter, OpenAI, E2B, Convex, WorkOS, Trigger.dev) before the dev server starts
• No explanation of what the sandbox can access or how the agent distinguishes real vulnerabilities from false positives

Verdict Worth a look if you are building multi-step AI agents that need durable execution and sandboxed code running, particularly in security-sensitive domains. Skip it if you want a self-contained pentesting tool or clear documentation on attack methodologies.