---
title: "Discussion on \"The Bug That Made My Pentesting Agent Give Up\n\" | Hashnode"
description: "Discussion on \"The Bug That Made My Pentesting Agent Give Up\n\". I’ve been building Halo, an autonomous pentesting agent powered by a local LLM (Gemma 4 12B, abliterated, running via LM Studio). Last week I found a bug in it that taught me more about state management in agentic systems than anything else I’ve hit so far."
url: "https://hashnode.com/posts/the-bug-that-made-my-pentesting-agent-give-up/6a4c10e47b6d490fc0580230"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [The Bug That Made My Pentesting Agent Give Up](https://halosecurityhasnodedev.hashnode.dev/the-bug-that-made-my-pentesting-agent-give-up?utm_source=hashnode&utm_medium=feed)

I’ve been building Halo, an autonomous pentesting agent powered by a local LLM (Gemma 4 12B, abliterated, running via LM Studio). Last week I found a bug in it that taught me more about state management in agentic systems than anything else I’ve hit so far.

Jul 6 · 3 min read · halosecurityhasnodedev.hashnode.dev  
Read the article

-   [#ai-agents](https://hashnode.com/tag/ai-agents)
-   [#hacking](https://hashnode.com/tag/hacking)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#autonomous-agents](https://hashnode.com/tag/autonomous-agents)
-   [#autonomous-ai-agents](https://hashnode.com/tag/autonomous-ai-agents)
-   [#red-team](https://hashnode.com/tag/red-team)
-   [#mcp](https://hashnode.com/tag/mcp)
-   [#google](https://hashnode.com/tag/google)
-   [#gemma](https://hashnode.com/tag/gemma)
-   [#pentesting](https://hashnode.com/tag/pentesting)
-   [#pentesting-tools](https://hashnode.com/tag/pentesting-tools)

## Written by

[Chris Sheridan](https://hashnode.com/@auto-majicly)

@auto-majicly · Phoenix,USA

  
[View profile](https://hashnode.com/@auto-majicly)

Sharing thoughts on bulids, industry standards and the Developer community as a whole.

I am an AI enthusiast, developer and cybersecurity, red-team researcher

## Responses 5

Markdown supported · ⌘↵ to post

[Chris Sheridan](https://hashnode.com/@auto-majicly)

[Jul 8](https://hashnode.com/posts/the-bug-that-made-my-pentesting-agent-give-up/6a4c10e47b6d490fc0580230/comment/6a4e80952f61a269f07e475a)

We appreciate your confidence in our project and hope that you will enjoy following along as we are currently under new developments. Sanitation parse blocks, automated sandboxing of custom scripts, and much more.

[Chris Sheridan](https://hashnode.com/@auto-majicly)

[Jul 8](https://hashnode.com/posts/the-bug-that-made-my-pentesting-agent-give-up/6a4c10e47b6d490fc0580230/comment/6a4e804147d111e3cb29ee5e)

We appreciate your confidence in our project and hope that you will enjoy following along as we are currently under new developments. Sanitation parse blocks, automated sandboxing of custom scripts, and much more.

[Opportunity Biz](https://hashnode.com/@opptybiz)

[Jul 8](https://hashnode.com/posts/the-bug-that-made-my-pentesting-agent-give-up/6a4c10e47b6d490fc0580230/comment/6a4e04c363e2e844460da619)

the fix is right, but there's a layer under it worth naming: the problem isn't just the scope of the cache key — it's that all failure types ended up in the same "blacklisted" bucket.

a permission-denied on a target is probably valid to carry forward (the tool genuinely can't run there). a timeout is likely transient. a missing dependency is global. three different failure types, three different valid scopes.

engagement-scoped keys solve the worst case, but failure-type classification is what determines which scope actually applies. your simplified note at the bottom already points at this — it's the real extension of what you built.

[Cai](https://hashnode.com/@cailab)

[Jul 7](https://hashnode.com/posts/the-bug-that-made-my-pentesting-agent-give-up/6a4c10e47b6d490fc0580230/comment/6a4d210bcb787c0e8278d7a7)

Good writeup. The engagement-scoped cache pattern you landed on is the right fix, and it mirrors something that shows up across agent systems more broadly: every piece of cached state needs an explicit scope boundary that matches its validity domain. The same trap appears in idempotency keys on tool results. If a tool call returns a transient error and the result gets cached without a request-scoped idempotency key, the next call against a different target inherits the stale negative result. We started threading request IDs through the entire execution chain for the same reason you added engagement\_id. The silent-failure property you mention is the dangerous part. A cache that quietly accumulates false negatives is harder to detect than a crash.

[Chris Sheridan](https://hashnode.com/@auto-majicly)

[Jul 7](https://hashnode.com/posts/the-bug-that-made-my-pentesting-agent-give-up/6a4c10e47b6d490fc0580230/comment/6a4d210bcb787c0e8278d7a7#reply-6a4d27186c3c5c5a455900b4)

Well we appreciate the insight. We will keep our eyes on the silent-failure for sure. Today we should be finalising the multi-agent system that relies on specialists for specialist tasks. Hope that you'll tune in to watch it unfold.