The Autonomous Offensive LLM Handbook has grown from an argument about trustworthy findings into a practical builder's field manual. It starts with a complete fixture run, then asks you to implement the pieces around a model: policy, recording, action admission, memory, evidence handling, recovery, and reporting. Each step leaves a test and an artifact to inspect.
The guiding line remains the model proposes; the code disposes. The model can suggest work and interpretations. The host application owns authorization, permitted actions, budgets, evidence records, and the decision to accept a claim. None of that makes the model deterministic or the result automatically correct.
Start with a run you can inspect
The recommended offline harness lab uses frozen inputs and a synthetic proof rule. It makes no network request and calls no model. You can follow a proposed finding through a governed severity, a refused raise, an accepted synthetic marker, and a report that records skipped or unfinished work. Every finding still requires human review; the lab is a control reference, not a finished report-signing workflow.
The course then connects proposals from a fake provider, tests hostile text and bounded repair, and assembles an application around a model transport. Even when you bring a real model to the example, the included tool actions remain on fixtures. It is not a live pentesting product in disguise.
Build the boundaries in the right order
The lessons move from policy and one recording path through stages, candidate selection, retrieval, context assembly, evidence verification, and stop/recovery logic. Optional controller lessons explore baseline selection, a contextual bandit, and a mushroom-body-inspired scheduler after the core boundary is working.
The difference between a claim and a proposal is central. A claim about the past needs a bound capture and a check appropriate to the asserted impact. A proposal about the future needs authorization and a permitted execution path; quoting an old response cannot validate a test that never ran. A matching quote establishes citation integrity, not exploitability.
Read the failures as carefully as the design
The repository keeps a historical case study and failure museum alongside the newer harness. The historical path has documented control gaps; the offline lab does not retroactively repair it. The evidence register keeps execution, analysis, review, and reproducibility status separate.
Two public preprints sit beside the handbook. The verifier study tests what a verifier-and-acceptance stage changes in lab reports, with independent human blind adjudication still pending. The scheduling study tests duplicate-action discipline under fixed budgets, not vulnerability-discovery superiority. Neither paper turns the handbook's teaching examples into a validated production agent.
If you want to learn by building, start with the online course. If you want to audit the implementation and its caveats, open the source repository and run the documented offline tests.