Topics / #ai-penetration-testing

AI penetration testing projects on GitHub

Using autonomous AI agents to run penetration tests and security assessments.

As of , the most-starred AI penetration testing projects on GitHub are strix (69.3K stars), shannon (49.1K stars) and hexstrike-ai (12.9K stars). GitHub.Locker tracks 6 AI penetration testing repositories with 146.2K stars combined. The fastest-growing on October 17 was strix, with +234 stars in a day.

6Projects
146.2KStars in total
+469Stars in a day
Browse in the catalog →github.com/topics/ai-penetration-testing ↗

Hot right now

Most stars gained in a day · Oct 17

+234

strix

usestrix/strix · ★ 69.3K

Strix is an open-source tool that uses autonomous AI agents to pentest your application like real hackers: it runs your code dynamically, finds vulnerabilities, and proves them with working exploits instead of just flagging suspicious patterns.

+114

Decepticon

BitterSecurity/Decepticon · ★ 6.3K

Decepticon is a professional autonomous Red Team agent that runs full attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would, instead of just scanning and printing a report.

+67

shannon

KeygraphHQ/shannon · ★ 49.1K

Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

+29

hexstrike-ai

0x4m4/hexstrike-ai · ★ 12.9K

HexStrike AI MCP Agents is an MCP server that lets AI agents like Claude, GPT, or Copilot autonomously run 150+ real cybersecurity tools for automated pentesting, bug bounty hunting, CTF challenges, and vulnerability discovery.

The all-time top

6 projects · by stars

  1. #1 · usestrix/strix

    strix

    Strix is an open-source tool that uses autonomous AI agents to pentest your application like real hackers: it runs your code dynamically, finds vulnerabilities, and proves them with working exploits instead of just flagging suspicious patterns.

    69.3K
  2. #2 · KeygraphHQ/shannon

    shannon

    Shannon is an autonomous AI pentester that analyzes your web application's source code, maps attack vectors, and then executes real exploits against the running app to prove vulnerabilities before they reach production — 'no exploit, no report'.

    49.1K
  3. #3 · 0x4m4/hexstrike-ai

    hexstrike-ai

    HexStrike AI MCP Agents is an MCP server that lets AI agents like Claude, GPT, or Copilot autonomously run 150+ real cybersecurity tools for automated pentesting, bug bounty hunting, CTF challenges, and vulnerability discovery.

    12.9K
  1. 4

    CyberStrikeAI

    7.9KAIPentest/CyberStrikeAI · Go

    CyberStrikeAI is an AI-native cybersecurity platform that turns natural-language intent into governed, auditable security operations, using agents, 100+ security tools, MCP integration, and attack-chain tracking for authorized penetration testing.

  2. 5

    Decepticon

    6.3KBitterSecurity/Decepticon · Python

    Decepticon is a professional autonomous Red Team agent that runs full attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would, instead of just scanning and printing a report.

  3. 6

    VulnHunter

    740nealbridges/VulnHunter · Python

    An open-source, agentic AI security scanner that reasons like an attacker to find exploitable vulnerabilities in source code, proves them with executable proof-of-concept exploits, and fixes them test-first. It is a maintained fork of Capital One's VulnHunter, rebuilt to run on any agent harness instead of just Claude Code.

Often tagged together