You can run an autonomous pentester on a $20 ChatGPT plan

An autonomous security agent is a token furnace. It reads pages, reasons about them, tries things, reads the results, and tries again, all on its own, for as long as the target holds out. SwarmAttacker burns an average of 2.14 million tokens per target. That is not a typo. One run against one web app, millions of tokens.

On most AI security tools that number is a problem, because most of them want an API key and bill you for every one of those tokens. Point the agent at a harder target and the meter spins faster. Run it a hundred times and you find out exactly how expensive curiosity is. For a student, a solo researcher, or anyone kicking the tires on a weekend, a metered bill that scales with every experiment is enough to make you close the tab.

So we made SwarmAttacker default to something different: your ChatGPT plan.

Sign in once, no API key

SwarmAttacker's default backend is Codex. If you have the Codex CLI installed and you have signed into it with your ChatGPT account, SwarmAttacker quietly reuses those same OAuth tokens. There is no key to generate, paste, or rotate, and no billing dashboard to watch with one eye. You authenticate once the way you already do to use ChatGPT, and the agent drives GPT-5.5-class models straight through ChatGPT's own backend.

The practical effect: a frontier-model penetration testing agent runs on a laptop against the same ~$20/month ChatGPT Plus plan millions of people already pay for. Not a special enterprise tier, not a provisioned API account with a spending limit you set nervously. The plan you might already have open in another tab.

The subscription you use to ask ChatGPT about dinner recipes can also run a fully autonomous security agent. Same login, same flat monthly price.

The honest part: caps exist

A ChatGPT plan is not an all-you-can-eat API. Plus and Pro come with usage caps, the rolling 5-hour and weekly limits you have probably bumped into during a long session. A 2.14-million-token agent can absolutely hit them.

The difference is what happens next. A naive tool that hits a cap throws an error mid-run and leaves you with a half-finished job and a stack trace. SwarmAttacker treats a cap as a pause, not a crash. When it sees the limit, it backs off and waits for the window to reset, then picks the run back up where it left off. You lose time, not progress. The trade you are making is clear and fair: a flat monthly price and a rate limit, instead of an open meter that never stops running.

You are not locked in

Codex is the default, not a cage. The backend is a swap, so if the ChatGPT route does not fit your setup you can point SwarmAttacker at a different provider without touching the rest of the agent.

• ChatGPT subscriptiondefaultvia the Codex backend — no API key
• OpenAI APIbring your own key
• AnthropicClaude models
• OpenRouterany hosted model
• LocalOllama / llama-server, fully offline

Bring your own OpenAI key if you want the raw API. Run Claude models through Anthropic. Route through OpenRouter to reach almost anything hosted. Or go fully offline with a local open-source model through Ollama or llama-server, no cloud and no bill at all. The agent does not care which brain it is thinking with; that is a deliberate design choice, not an accident.

Why this matters

For years, running a serious autonomous security agent meant a serious infrastructure story: an API account, a budget, and enough nerve to let a loop that retries on its own spend real money while you sleep. That gate kept a lot of capable people out. The interesting research on LLM-driven pentesting happened on funded machines, not on the laptop of whoever was curious that afternoon.

Defaulting to a ChatGPT subscription knocks that gate down. If you can afford Plus, you can run a frontier-model security agent tonight, against a lab target you own, and learn how the thing actually behaves. That is the whole point: the best way to understand autonomous pentesting is to watch one work, and now the price of watching is a subscription you may already be paying for.

Curious how the agent spends all 2.14 million of those tokens? That is the story of how it works.