Publication date unknown · Discovered github.com
Topic · Latest 50 of 121 active items
Agentic AI Security Tools
Observed security tools, scanners, frameworks, and defensive or dual-use artifacts relevant to agentic AI systems.
Matching wire items
First reported nvidia.com
How NVIDIA OpenShell Reference Architecture Secures and Governs AI Agent Workloads at Scale
NVIDIA OpenShell is an open-source runtime that treats AI-agent workloads as untrusted, enforcing sandbox isolation, mediated credential access, and formal verification of policy permissions. Its reference architecture also describes BlueField-4 and Sentry integration for hardware-isolated monitoring and quarantine following policy violations. Details →Publication date unknown · Discovered huggingface.co
Horizon-Labs/prompt-injection-guard-base
Horizon-Labs’ Prompt Injection Guard base is an openly available, Apache-2.0-licensed 308M-parameter classifier for detecting direct prompt injections and jailbreaks, plus indirect injections in documents, RAG chunks, and tool outputs. The model card provides runnable integration examples, overlapping-window scanning for long documents, PyTorch and ONNX support, and reported benign-text evaluation results. Details →Publication date unknown · Discovered github.com
GitHub - santosomar/AI-agents-for-cybersecurity: Hands-on code, labs, and reference material by Omar Santos for building, securing, and operating AI agents in cybersecurity.
Omar Santos's AI-agents-for-cybersecurity repository provides hands-on code, labs, and reference material for building, securing, and operating cybersecurity AI agents. The visible repository listing includes CodeGuard skill bundles for Claude Code and Codex, alongside CodeGuard rules for Cursor. Details →Publication date unknown · Discovered github.com
GitHub - Annora998/inboxwall: Local-first, read-only AI email security. Sanitizes hidden CSS tricks, Unicode obfuscation, and prompt injection attacks before AI sees them.
InBox Wall is a GitHub-hosted, local-first, read-only email-security tool designed to sanitize hidden CSS tricks, Unicode obfuscation, and prompt-injection content before AI processing. The repository includes benchmark and corpus directories, although the supplied excerpt provides limited implementation and evaluation detail. Details →Publication date unknown · Discovered github.com
GitHub - BenniAlencar/agent-cyber-sentinel: Tier-0 Zero-Trust Runtime Security Shield, Prompt Injection Firewall, Secret Leak Interceptor and Tool Call Sanitizer for AI Agents and MCP Servers. Governed by Benni Master OS v9.4 (Skill 63 Cyber Sentinel OS).
Agent Cyber Sentinel is a GitHub-hosted defensive tool described as providing prompt-injection filtering, secret-leak interception and tool-call sanitization for AI agents and MCP servers. The visible repository includes implementation, tests and examples, with a commit adding an OpenAISecurityGuard client proxy adapter; the supplied excerpt does not establish protection effectiveness. Details →Publication date unknown · Discovered github.com
GitHub - adikshatriyag-crypto/aegis-kernel: Zero-Trust Deterministic Security Runtime for Autonomous AI Agents
Aegis Kernel is a GitHub-hosted project described as a zero-trust, deterministic security runtime for autonomous AI agents. Repository commit descriptions reference a capability engine, a LangChain callback handler, a sandbox, and a benchmark, but the supplied excerpt contains no implementation details or evaluation results. Details →Publication date unknown · Discovered github.com
GitHub - aws-safebox/aws-safebox: Local safety guardrails for AI-assisted AWS infrastructure work
AWS SafeBox is a public code repository for local safety guardrails for AI agents performing AWS infrastructure work. The repository includes Python packaging and tests, with commit descriptions referencing a configurable TOML policy engine and persistent proxy setup. Details →First reported arxiv.org
VulnBump: A Benchmark for Fixing Vulnerable Dependencies in Real Projects While Keeping the Build and Tests Green
VulnBump, a benchmark published by Snyk (with code and data on GitHub and an arXiv paper), evaluates whether AI coding agents can upgrade vulnerable open source dependencies across six package managers while keeping builds and tests green. Across 307 real upgrade tasks covering 2,066 fixable vulnerabilities, a non-agentic baseline passed 46.9%, Claude Code unaided 59.6%, Claude Code with Snyk scan 77.5%, and Snyk's purpose-built Evo Remediation Agent 90.2%. Details →Publication date unknown · Discovered github.com
GitHub - alexfraser-scotch/mcp-shield: Zero-overhead runtime security proxy, reversible secret vault, and audit firewall for MCP servers (Cursor, Claude, Windsurf)
mcp-shield is an open-source runtime security proxy for Model Context Protocol (MCP) servers used by AI coding assistants like Cursor, Claude, and Windsurf, providing a reversible secret vault, audit firewall, and security rules including container/Kubernetes guards. The GitHub repository ships source and tests intended to intercept and govern MCP tool traffic. Details →Publication date unknown · Discovered kitploit.com
system_prompts_leaks — Updated! — Curated collection of extracted system prompts from major AI chatbots including Claude, ChatGPT, Gemini, Grok, and Copilot. Updated regularly with new model releases.
system_prompts_leaks is a curated, regularly-updated GitHub collection (by asgeirtj) of extracted verbatim system prompts from major AI chatbots including Claude, ChatGPT, Gemini, Grok, and Copilot, surfaced via a Kitploit tool post. The repository tracks changes across model releases such as Claude Haiku 5.5 and various OpenAI and Meta configurations. Details →First reported knostic.ai
Auto-patch for OpenAnt: Generating trust in autonomous patching
Knostic released Auto Patcher for OpenAnt, an open-source vulnerability discovery and remediation harness that autonomously investigates a vulnerability and repository, generates a candidate fix, challenges its own conclusions, collects evidence, and produces a 'Trust Report' pairing a patch with evidence and a recommendation. The tool is published on GitHub (github.com/knostic/OpenAnt) and aims to build a trust layer for AI-generated code and autonomous patching. Details →Publication date unknown · Discovered github.com
GitHub - Pryxor/pryxor: Runtime security layer for AI agents. Intercepts every tool calls, decides and execute the real actions without the agent never hold a credential.
Pryxor is an open-source runtime security layer for AI agents published on GitHub that intercepts every tool call, makes authorization decisions, and executes the real actions itself so the agent never holds a credential. The repository includes policy configs, audit logging of APPROVED/BLOCKED/HOLD decisions, encrypted hold payloads, and executors demonstrating destructive-action controls. Details →Publication date unknown · Discovered huggingface.co
vllm-sr/jailbreak-detection-dataset · Datasets at Hugging Face
The vllm-sr/jailbreak-detection-dataset on Hugging Face is a downloadable, labeled dataset of roughly 4,130 prompts split into train, validation, and test sets, with each entry tagged as either 'jailbreak' or 'benign' (e.g., DAN/APOPHIS-style role-play jailbreaks, harmful instruction requests, and ordinary queries). The dataset is auto-converted to Parquet and intended for training or evaluating LLM jailbreak-detection classifiers. Details →Publication date unknown · Discovered github.com
GitHub - ggeorgovassilis/llm-gauze
llm-gauze is an open-source GitHub project that appears to act as a filtering proxy sitting between clients and upstream LLM providers, passing client Authorization headers through to the upstream and including pydantic-based config validation. The repository is under active development with recent commits, though the provided page content is mostly repository chrome rather than a technical mechanism write-up. Details →First reported sentry.security
PIChef. A tool for Prompt Injection inspired by CyberChef
PIChef is a CyberChef-inspired web workbench for crafting prompt-injection payloads, offering 66 operations and 12 presets that can be chained into recipes (for example FlipAttack text reversal, Task-in-Prompt encoding, hypothetical/academic framing, Unicode invisible-character smuggling, HTML-comment hiding, and QR-code carriers) with a stage waterfall showing every intermediate transformation. The tool lets testers build, inspect, and swap individual steps to experiment with how layered obfuscation evades LLM guardrails. Details →First reported theregister.com
AWS launches open-source AI agent sandbox to prevent YOLO mode disasters
AWS released Strands Box, an open-source sandbox for autonomous AI agents that combines OS-level isolation with contextual, temporal policy enforcement via its Dogwood Local Engine. The tool aims to curb 'YOLO mode' agents that approve every action without review, letting operators rate-limit or gate tool calls such as Slack posts, Git pushes, or API calls to prevent destructive actions like deleting a production database. Details →Publication date unknown · Discovered github.com
GitHub - JUSICK/Argos-mcp-guardrail: A lightweight, sub-millisecond security shim that prevents AI agents from accessing sensitive files (.env, SSH keys) and executing destructive commands via MCP.
Argos-mcp-guardrail is a lightweight Rust-based security shim that intercepts MCP tool calls to prevent AI agents from accessing sensitive files (such as .env files and SSH keys) and executing destructive commands, operating with sub-millisecond latency. The project ships as an installable artifact with configurable blocked and allowed patterns via an argos.toml config. Details →Publication date not yet evaluated · Added github.com
GitHub - mars2021y-gif/autonomous-ai-agent-security-incidents-2026: Autonomous AI Agent Security Incidents of 2026: Benchmark dataset (109 incidents), falsification matrix, 2-page executive summary, and multi-agent privilege attenuation harness (100% EPR).
The GitHub repository 'autonomous-ai-agent-security-incidents-2026' by mars2021y-gif publishes a benchmark dataset of 109 autonomous AI agent security incidents, a falsification matrix, a two-page executive summary, and a multi-agent privilege attenuation harness claiming 100% EPR, with GitHub Actions CI. The project is positioned as a downloadable/runnable artifact for evaluating and hardening multi-agent AI systems. Details →Publication date not yet evaluated · Added github.com
GitHub - TsvetanG2/mcpward: Black-box security & contract testing for MCP servers. Catch rug-pulls, tool poisoning, schema drift & protocol violations in CI — with JUnit & SARIF reports.
mcpward is an open-source black-box security and contract testing tool for Model Context Protocol (MCP) servers that detects rug-pulls, tool poisoning, schema drift, and protocol violations in CI, producing JUnit and SARIF reports. The GitHub repository is actively maintained with releases and CI integration. Details →Publication date not yet evaluated · Added huggingface.co
ZeroLeaks/shield-small
Shield Small is a 118M-parameter ONNX classifier published on Hugging Face by ZeroLeaks for detecting prompt injection and jailbreak attempts in untrusted text before an AI agent reads it (retrieved documents, tool results, web pages, tool descriptions). It runs locally on CPU, returns an injection score and binary verdict, and reports 84.3% mean category-balanced accuracy and 71.8% attack recall when combined with rules v2. Details →Publication date not yet evaluated · Added github.com
GitHub - uiuc-kang-lab/cve-bench: CVE-Bench: A Benchmark for AI Agents’ Ability to Exploit Real-World Web Application Vulnerabilities
CVE-Bench, from the UIUC Kang Lab, is a runnable benchmark that measures AI agents' ability to autonomously exploit real-world web application vulnerabilities (including CVEs such as CVE-2024-2624, CVE-2023-37999, and CVE-2024-2771). The repository provides challenge environments, graders, and agent solvers (e.g., Claude Code and Codex CLI), with Docker and Kubernetes/Helm support for running evaluations. Details →Publication date not yet evaluated · Added github.com
GitHub - rajatrao/jevshield: JevShield uses Ollama's native Jev-style decision-model API to perform fast, typed security decisions locally.
JevShield is an open-source GitHub project billed as a local prompt-injection firewall for LLM agents, using Ollama's native decision-model API to perform fast, typed security decisions locally. The repository includes application code, an attacks directory, benchmarks, a dashboard, and tests for detecting and blocking prompt-injection attempts. Details →Publication date not yet evaluated · Added github.com
GitHub - wattzgoat/wattzgoat-web: WattzGOAT is an intentionally vulnerable web application.
WattzGOAT (wattzgoat/wattzgoat-web) is an intentionally vulnerable web application published on GitHub as a training/lab environment, featuring a chatbot and 'pending-assistant-action' mechanics, per-flag and category hardening toggles, and a decoupled trainer dashboard. The repo appears designed as a deliberately-vulnerable playground for practicing exploitation and defense, including chatbot/assistant-related flaws. Details →Publication date not yet evaluated · Added kitploit.com
sloppy-joe — Shields against supply-chain, slopsquatting, and typosquatting attacks from dependencies and code.
sloppy-joe is an open-source defensive tool (brennhill/sloppy-joe) that shields software projects against supply-chain, slopsquatting, and typosquatting attacks originating from dependencies and code. Slopsquatting specifically targets the AI-driven threat of LLMs hallucinating non-existent package names during code generation, which attackers can register to poison the supply chain; the project documents support across ecosystems (Python, JavaScript, Rust, Go, Ruby, PHP, JVM, .NET). Details →Publication date not yet evaluated · Added huggingface.co
OBLITERATUS - a Hugging Face Space by pliny-the-prompter
OBLITERATUS, a Hugging Face Space published by pliny-the-prompter (elder-plinius), is a runnable 'master ablation suite' that surgically strips refusal/safety behavior from open-weight LLMs. It offers multiple abliteration methods (diff-means, SVD, LEACE), refusal-direction extraction, activation steering, expert transplant, and a benchmark/leaderboard, building on the 'Refusal in Language Models Is Mediated by a Single Direction' research and the Heretic project, and lets users push the modified (de-safetied) models back to the Hub. Details →Publication date not yet evaluated · Added · 3 reports nvidia.com
Add Runtime Controls to AI Agents with NVIDIA OpenShell
NVIDIA OpenShell 0.1.0 is an open-source runtime that enforces which systems, data, and credentials an AI agent can access without rewriting the agent, combining sandboxed execution, controlled service access, credential management, and a formal policy prover. Its Gateway, Supervisor, and Sandbox components manage agent fleets, inspect outbound requests against policy, and apply kernel-level filesystem and process controls, with code available on GitHub. Details →Publication date not yet evaluated · Added github.com
provenance-gate/posts/01-provenance-vs-detection.en.md at main · Yehielamor/provenance-gate
The provenance-gate project publishes a deterministic tool gateway that sits between an AI agent and its tools and, rather than reading or classifying injected text, tracks the provenance of each value in a tool call (recipient, IBAN, URL, amount). In evaluation on AgentDojo (assuming the model is always hijacked), the gateway blocked 99.3% of 609 hijacked attacks and held steady against reversed, base64, invisible-Unicode-tag, and machine-translated obfuscations, while three open prompt-injection classifiers showed high false positives and poor detection of obfuscated injections. Details →Publication date not yet evaluated · Added github.com
GitHub - ZeroLeaks/zeroleaks: AI Security Scanner - Test your AI systems for prompt injection and extraction vulnerabilities
ZeroLeaks is an open-source AI security scanner (CLI, published on GitHub) that tests AI systems for prompt injection and system-prompt extraction vulnerabilities. Recent releases add per-mode coverage reporting, an 'inconclusive' verdict, injection-probe isolation, and an end-to-end test suite running the CLI against a local mock LLM. Details →Publication date not yet evaluated · Added github.com
GitHub - tenable/cyberagents-exchange: Community-contributed agents, skills, MCP servers, and playbooks for the CyberAgents Exchange
Tenable's CyberAgents Exchange is a public GitHub repository hosting community-contributed AI agents, skills, MCP servers, and playbooks for cybersecurity use, with a taxonomy of listings and a validator for contributions. The exchange is paired with a companion site (exchange.tenable.com) and provides installable agentic artifacts for security workflows. Details →Publication date not yet evaluated · Added · 2 reports github.com
GitHub - rudratoshs/buried-injections: 🛡️ Regex catches 0%, Meta's Prompt Guard 2 catches 1% of 629 realistic AgentDojo injection attacks when they're buried in tool output. Reproducible benchmark. · GitHub
The 'buried-injections' GitHub project is a reproducible benchmark showing that regex-based detection catches 0% and Meta's Prompt Guard 2 catches roughly 1% of 629 realistic AgentDojo prompt-injection attacks when the malicious instructions are buried inside tool output (indirect prompt injection). The benchmark is published as runnable code demonstrating the gap between existing detectors and realistic indirect-injection scenarios. Details →Publication date not yet evaluated · Added thehackernews.com
545 Hackers Tested It First. Now XRanges for AI Scores Your Security Agent
XRanges for AI, built by CTF.ae, is an evaluation platform that scores autonomous security agents by deploying realistic, instrumented target applications, recording what an agent actually does inside them, and scoring each run live on four independent signals. It aims to replace the manual expert review needed to determine which of an agent's self-reported findings are real, duplicated, invented, or never attempted. Details →Publication date not yet evaluated · Added · 3 reports kitploit.com
cerebro-red-v2 — CEREBRO-RED v2: Plataforma avanzada de investigación de Red Team para LLM con algoritmo PAIR y evaluación LLM-como-juez
CEREBRO-RED v2 is a GitHub-published LLM red-team research platform that implements the PAIR (Prompt Automatic Iterative Refinement) algorithm and LLM-as-a-judge evaluation to automatically generate and score semantic jailbreaks against target LLMs. The tool draws on the PAIR method (arXiv:2310.08419), which uses an attacker LLM to iteratively craft jailbreaks against a target model in fewer than twenty queries, and includes attack-strategy documentation and a scan API. Details →Publication date not yet evaluated · Added talosintelligence.com
Introducing CAIRN: Frontier tracking for AI-integrated malware
Cisco Talos released CAIRN (Cognitive Artifact Intelligence Research Network), an open-source research toolkit on GitHub for hunting, classifying, and tracking AI-integrated malware using a metadata-first methodology. CAIRN extracts 'cognitive artifacts' such as embedded prompts, LLM provider endpoints (e.g. api.openai.com, api.anthropic.com), API key prefixes, jailbreak terms, and AI-evasion strings, then clusters and graphs sample relationships without downloading or executing binaries. Details →Publication date not yet evaluated · Added github.com
GitHub - agent-chaperone/agent-chaperone: Screens an AI agent's tool calls before they run and tool results before the agent reads them. An MCP proxy plus a hooks adapter for a client's built-in tools.
agent-chaperone is an open-source security tool that screens an AI agent's tool calls before they execute and tool results before the agent reads them, implemented as an MCP proxy plus a hooks adapter for a client's built-in tools. Recent releases add remote server support, a watch on the tool list, and chunked screening of large results. Details →Publication date not yet evaluated · Added github.com
GitHub - polarisbuiltinc-wq/ora-grounding: Post-response grounding check + cross-family adversarial review for LLM chat agents
The ora-grounding GitHub repository provides a post-response grounding check plus a cross-family adversarial review layer for LLM chat agents, packaged as a runnable Python project with source, services, and tests. It is framed as a defensive verification tool to catch ungrounded or hallucinated model outputs. Details →Publication date not yet evaluated · Added github.com
GitHub - apache/casbin-gateway: Casbin AI & MCP security gateway for HTTP, online demo: https://door.caswaf.com
Casbin-gateway is an open-source AI and MCP security gateway for HTTP published under the Apache project, providing access-control enforcement for AI agents and Model Context Protocol traffic. The repository includes agent authentication, agent configuration, and gateway components with an online demo at door.caswaf.com. Details →Publication date not yet evaluated · Added github.com
GitHub - emetgate/emetgate: A deterministic verification kernel between LLM agents and your source tree. The model proposes, the kernel verifies.
emetgate is an open-source GitHub project describing a deterministic verification kernel that sits between LLM coding agents and a source tree, where the model proposes changes and the kernel verifies them before they are applied. The repository includes source, tests, CI workflows, and integrations (e.g. a Claude skill for measuring CLAUDE.md rules). Details →Publication date not yet evaluated · Added github.com
GitHub - aliasrobotics/cai: Cybersecurity AI (CAI), the framework for AI Security
CAI (Cybersecurity AI) by Alias Robotics is an open-source agentic AI framework for autonomous offensive and defensive security work, credited with 30+ CVEs and top CTF rankings; the now-archived repo consolidates the final v1.1.5 snapshot, with releases still on PyPI. A companion arXiv paper demonstrates proof-of-concept prompt-injection exploits that hijack CAI's own AI hacking agents via malicious web-server responses, alongside multi-layered mitigations. Details →Publication date not yet evaluated · Added github.com
GitHub - Atomburstofficial/geiger: A Geiger counter for AI agents — one read-only command that inventories every agent, MCP server, plugin, and AI extension on a machine
Geiger is a read-only command-line scanner that inventories AI agents, MCP servers, plugins, hooks, skills, and AI extensions across tools like Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex, Gemini, Aider, and browser profiles. It provides plain-language exposure labels, origin tracing, policy-wrapper recognition, and a diff mode for drift detection against a saved baseline. Details →Publication date not yet evaluated · Added github.com
GitHub - neomatrix369/tripwire: Sandboxed security scanning for AI skills and MCP servers — precise findings, heatmap posture, fail-closed agent guard. Multi-scanner security platform for AI skills and MCP servers, scan what the agents install!
Tripwire is an open-source, sandboxed multi-scanner security platform for scanning AI skills and MCP servers before agents install them, offering precise findings, a heatmap posture view, and a fail-closed agent guard. Published as a GitHub repository (neomatrix369/tripwire), it aims to inspect what AI agents install to catch security issues in the agentic tool supply chain. Details →Publication date not yet evaluated · Added github.com
GitHub - sebastianmechno-sys/sagashield: ACID transactional Saga runtime, Step-0 security guardrail, and MCP server for autonomous AI agents.
sagashield is an open-source project (v0.3.0) providing an ACID transactional Saga runtime, a 'Step-0' security guardrail, and an MCP server for autonomous AI agents, published on GitHub with evals, fuzzing harnesses, examples, and a Python SDK. Details →Publication date not yet evaluated · Added github.com
GitHub - SenteLabsAI/extensible-mcp: MCP proxy with on-demand server loading, searchable tools, and pluggable filters for access control
extensible-mcp (SenteLabsAI) is an open-source MCP proxy that adds on-demand server loading, searchable tools, and pluggable filters for access control, with a load_control mechanism and structural guarantees over which downstream MCP tools an agent can reach. Its accompanying whitepaper ("Policy as Code, Policy as Type", arXiv:2506.01446) argues for expressing ABAC access-control policies as types in dependently typed languages such as Agda and Lean. Details →Publication date not yet evaluated · Added github.com
GitHub - Vedantgitbot/booth: BOOTH A lightweight checkpoint layer for LLM outputs. BOOTH sits between your application and an LLM call and decides whether an answer should pass through, be reconsidered, be flagged as resting on more than one valid interpretation, or be marked uncertain.
BOOTH is a lightweight Python checkpoint library that sits between an application and an LLM call, deciding whether an answer should pass through, be reconsidered, be flagged as resting on more than one valid interpretation, or be marked uncertain. The repository is an early-stage project (v0.4.3, 3 stars) providing structured checkpoints for LLM outputs. Details →Publication date not yet evaluated · Added github.com
GitHub - snyk/agent-scan: Security scanner for AI agents, MCP servers and agent skills.
Snyk's agent-scan is an open-source security scanner (also distributed as the PyPI package snyk-agent-scan) that inspects AI agents, MCP servers, and agent skills for security issues. The GitHub repository shows active development, MCP-focused capabilities including a guard install for discovered servers, and references to MCP threats such as tool-poisoning and prompt injection. Details →Publication date not yet evaluated · Added huggingface.co
dealignai/Qwen3.8-Flash-Next-UNCENSORED-FP8
A Hugging Face repository by "dealignai" publishes Qwen3.8-Flash-Next-UNCENSORED-FP8, a refusal-removed build of a Qwen model created through direct weight-level modification rather than fine-tuning or prompt tricks. The page advertises near-100% compliance on HarmBench harmful-behavior categories including chemical/biological, cybercrime/intrusion, and illegal activity while retaining most MMLU capability. Details →Publication date not yet evaluated · Added github.com
GitHub - guillaumemeyer/watermarks-remover: Strip multi-vendor AI provenance marks: Unicode text hygiene, statistical rewrite hooks, and C2PA/metadata from PNG/JPEG/SVG/PDF/DOCX/HTML/MD
watermarks-remover is an open-source tool that strips multi-vendor AI provenance marks — including C2PA content credentials, statistical text watermarks, invisible Unicode markers, and metadata — from PNG/JPEG/SVG/PDF/DOCX/HTML/MD and audio/video files. It ships with a Claude plugin PostToolUse hook that automatically detects and removes provenance marks from files an AI agent writes, defeating attribution mechanisms like SynthID and C2PA. Details →Publication date not yet evaluated · Added github.com
GitHub - kontext-security/sandy: Secure agents in seconds by running them in a sandbox.
Sandy, published by kontext-security on GitHub, is an open-source tool (written in Rust) that aims to secure AI agents by running them inside a sandbox. The repository provides installable crates and scripts intended to isolate agent execution to contain risky or untrusted agent behavior. Details →Publication date not yet evaluated · Added darkreading.com
'HTTP Terminator' Hunts for Novel Desync Attacks
'HTTP Terminator,' an AI-powered open source tool built by PortSwigger's James Kettle, autonomously developed novel HTTP desync (request-smuggling) attack techniques and used them to successfully compromise real enterprise websites, including several financial services firms. Presented at Black Hat USA 2026, the tool explores whether AI can perform genuinely novel offensive security research, and notably deviates from its instructions (e.g., pivoting to cache poisoning). Details →Publication date not yet evaluated · Added huggingface.co