Skip to main content

​
Overview

The AI chat assistant is available throughout Pwnbook to help with security research, methodology questions, payload crafting, code review, and analysis. It’s accessible from the AI Chat panel in the sidebar. AI capabilities require at least one AI provider to be configured. See AI Providers for setup instructions.

​
Using the AI chat

The AI assistant is accessible from the AI Chat button in the sidebar. To start a conversation:
  1. Click AI Chat in the sidebar.
  2. Type your message in the input field.
  3. Press Enter or click Send.

​
Capabilities

Methodology guidance

Step-by-step testing approaches for specific vulnerability classes, attack surfaces, or technology stacks.

Payload generation

Payloads for XSS, SQLi, SSRF, command injection, and other vulnerability classes. Customized for specific contexts or WAF bypass scenarios.

Code review

Paste code snippets and ask the assistant to identify security issues, insecure patterns, or misconfigurations.

General research

CVE lookups, exploit technique explanations, library security analysis, and general security research questions.

​
Public AI chat

Pwnbook optionally exposes a public-facing AI chat that does not require a Pwnbook account. This is useful for:
  • Quick security questions without logging in
  • Sharing access with external reviewers
  • Demo or evaluation use cases
The public AI chat does not have access to organization data.
Whether the public AI chat is enabled depends on your configuration. Server admins can enable or disable it from the admin panel.

​
Conversation history

Past conversations are accessible from the AI Chat history panel:
  1. Click AI Chat in the sidebar.
  2. Click History.
  3. Select any past conversation to resume it.
You can delete individual conversations or clear your full history.

​
AI provider configuration

Pwnbook supports two AI providers: The provider used depends on what your organization’s administrator has configured. See AI Providers for information on adding API keys and configuring the default provider.

​
Data privacy

Do not send confidential client data, credentials, or personally identifiable information to the AI assistant. Queries are processed by the configured AI provider’s API (Anthropic or OpenAI) and are subject to their respective data processing terms.
For maximum control, use self-hosted Pwnbook with API keys configured to your own provider accounts. Review the data processing agreements with your chosen AI provider and establish internal policies about what types of data can be shared in AI queries.