▸ pentest-swarm-ai · open_source
Machine-Speed Attacks.Human-Level Reasoning.
Built for your cloud infra. A swarm of autonomous AI agents that chains vulnerabilities — across APIs, web apps, and infrastructure — the way a real attacker would. Open-source so you can audit the reasoning. Deployed against your stack by the team that built it.
A swarm of specialists. One coordinated attack.
Eight specialist agents share a single blackboard — each one recon, auth, web, cloud, IaC, supply chain, network, exploitation. They chain findings across surfaces the way a real adversary would, and the reasoning is reproducible and auditable. No black-box scanners.
▸ engagements
Want it run against your stack?
The team that built the swarm will deploy it against your production-grade environment, validate findings by hand, and hand back a report your engineers will actually use.
Talk to the teamEight specialists. One shared brain.
Each agent has a single specialty. They share state through a stigmergic blackboard — a finding from one agent immediately becomes input for the next. That's how the swarm reasons across surfaces a single tool would never chain.
Hire the team. Use the full arsenal.
Don't run the swarm alone. The people who wrote it will deploy it against your environment, validate every chain by hand, and walk your engineers through the report. Plus the full open-source arsenal we maintain alongside it.
The team that built the swarm, deployed against your stack.
- ✓Senior operators run the swarm against your production stack
- ✓Every chained finding hand-validated — zero noise in the report
- ✓Audit-ready report + reproducible run logs your engineers can re-run
- ✓One-off engagement or continuous cadence
Open-source tools the same team maintains.
Specialised modules for the offensive-security stack — auditable, forkable, deployable. Each one solves a specific problem the swarm keeps running into.
vibescan
//Scan AI-generated code for vulnerabilities — 30+ tools, 15+ languages, sandboxed exploit simulation in the loop.
agat
//Analyze polymorphic, metamorphic, and AI-rewritten malware. Built ahead of the threat, not after it lands.
skillscan
//Audit Claude Skills before you install them. Prompt injection, exfiltration paths, supply-chain attacks.
akira
//Graph-based attack-path simulator for AI-augmented systems. MITRE ATT&CK plus AI-specific vectors.
The Pentest Dojo. Train for the post-AI war room.
A free open-source curriculum for AI-assisted offensive security — the first generation of labs that take post-AI threat models seriously. Agentic recon, model-aware testing, prompt-injection chains, swarm orchestration. Vendor-agnostic. Runs on your laptop.
- LAB_01agentic_recon●○○○
- LAB_02autonomous_exploit●●○○
- LAB_05agent_trust_boundaries●●○○
- LAB_03model_aware_testing●●○○
- LAB_04prompt_injection_chains●●●○
- LAB_06swarm_orchestration●●●○
- LAB_07supply_chain_for_ai●●●○
- LAB_08live_red_team_dojo●●●●