Pentest Swarm AI coordinates dozens of LLM-driven agents through a stigmergic blackboard to recon, classify, exploit and report on authorized web targets, positioning itself as an open, self-hosted alternative to closed SaaS offerings.
| Tool | Armur-Ai/Pentest-Swarm-AI — an open-source, Go-based autonomous API and web-app pentesting framework driven by a swarm of coordinated AI agents |
| Category | AI-augmented offensive security orchestration / autonomous penetration testing framework |
| Primary Use | Automating recon, vulnerability classification, exploitation chaining and evidence-backed reporting against authorized targets, bug bounty scopes, CTF labs and bundled vulnerable apps like crAPI, Juice Shop, VAmPI and DVGA |
| Safe Use | Explicitly restricted by the project's own disclaimer to authorized security testing, bug bounty programs with written permission, CTF competitions, and educational research; the bundled labs provide a fully legal local practice environment |
| Telemetry Note | The swarm produces heavy, concurrent scanning traffic against in-scope targets, writes findings into a pgvector blackboard, exposes a web dashboard on localhost:7777, and registers reverse-order cleanup traces — blue teams observing its use would see high-volume parallel probing characteristic of automated agents |
Armur-Ai/Pentest-Swarm-AI is a self-described open-source alternative to XBOW, the hosted AI pentesting SaaS that made headlines by topping bug bounty leaderboards. Where XBOW is closed, single-agent and cloud-billed, this project — written in Go 1.24, licensed under AGPL-3.0, and sitting at roughly 2,500 stars — inverts all three constraints: it is open source, self-hostable on your own infrastructure, and built around a genuine swarm of dozens of concurrent AI agents. The README is unusually explicit about the distinction, arguing that most tools marketed as multi-agent pentesters are really a single planner LLM dispatching through a fixed pipeline of recon, classify, exploit and report stages. That critique is the intellectual core of the project, and it is worth understanding before you ever run the binary.
The architecture rests on three swarm-intelligence primitives the authors name directly: stigmergy, emergence and decentralization. Stigmergy means the agents do not take orders from a central planner; instead they coordinate by reading and writing findings on a shared blackboard backed by pgvector. A finding carries a pheromone weight that biases other agents toward it and decays over time, so unpromising attack paths naturally go stale and die instead of consuming budget. Emergence means attack chains are not scripted: a recon finding wakes the classifier, a high-severity classification wakes the exploit agent, and exploit results feed back into the board to wake the reporting agent, with the order arising from blackboard state rather than a hardcoded sequence. Decentralization means each agent runs its own trigger predicate, so a new agent with its own predicate can join the swarm without anyone rewriting an orchestrator.
The pheromone mechanics are more granular than a naive TTL. The README describes per-finding-type decay half-lives: a PORT_OPEN finding stays hot for hours, while a SESSION finding decays within minutes, and both are configuration-driven. An architecture diagram shows thresholds at which agents fire — above roughly 0.5 weight the exploit agent engages, above 0.2 the classifier does, and below that the finding goes stale. The animated scoring loop the project calls adaptive attack-path scoring generates candidate strategies, scores them with what it labels a JEV metric against live state, pursues the best-scoring path, and reinforces successful behavior through pheromone updates. For anyone studying agent coordination in security tooling, this is one of the more fleshed-out open implementations of the concept.
On the offensive capability side, the README claims the swarm does not merely scan but exploits and proves what it finds — chaining BOLA/IDOR, JWT forgery, mass assignment, SSRF and injection classes into scored attack paths with captured evidence, rather than emitting unverified scanner-style maybes. The evidence-backed report is the terminal stage of that chain. The target audience is stated plainly: pentesters covering a broad scope overnight, bug bounty hunters racing to first-blood on fresh programs, red teamers needing breadth, and researchers exploring autonomous offense. This is a documentary observation of the project's claims, not an endorsement of running it anywhere you lack a signed scope.
Model flexibility is a deliberate design pillar. The harness works with Claude, anything OpenAI-compatible including Together AI's hosted Llama, Qwen and DeepSeek models, and fully local Ollama or LM Studio setups requiring no API key at all. The authors frame the project as the harness that gives those models hands — real tools, swarm coordination, scope safety and evidence-backed reporting — rather than competing with the underlying models. Notably for sensitive engagements, the local-model path means air-gapped operation with zero API cost and, in their words, not one byte of your data leaving your box. Prompt caching on Claude is enabled by default for the recon and classifier agents to cut cost and latency on repeated system prompts.
Installation is deliberately low-friction, with five distribution channels: npm install -g @armurai/pentestswarm, a curl-piped shell installer, a Homebrew tap, go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@latest, and a Docker image at ghcr.io/armur-ai/pentestswarm:latest. Running pentestswarm run with no flags opens an interactive TUI launcher where you pick a provider, paste a key or select local Ollama, and point the swarm at either a real in-scope URL or one of the bundled vulnerable labs — crAPI, Juice Shop, VAmPI or DVGA — which spin up, get attacked, and tear down automatically. That lab integration is the single best answer to the authorization question: it gives every capability the tool has a completely legal place to demonstrate itself. For scripting and CI, run wraps a scan subcommand with full flag support, and a GitHub Actions example workflow ships in deploy/github-action/example-workflow.yml.
Safety engineering inside the tool is described in more depth than most offensive frameworks bother with. Scope enforcement, per the README, happens twice — once at the tool layer and again at the executor — making the --scope flag non-bypassable by the agents themselves. Cleanup handlers are registered before any execution begins, so SIGINT, crashes and budget exhaustion all trigger reverse-order teardown of spun-up lab containers and artifacts, implemented in internal/pipeline/cleanup_memory.go and cleanup.go. A readiness check inside the launcher verifies Go, Docker, tooling and provider configuration, but never blocks — missing components surface as notes you can fix or ignore. For defenders, that scope discipline is worth knowing about precisely because it is the failure mode of lesser automated tooling.
Observability during a campaign is dual-channel: a web dashboard served on localhost:7777 and a full-screen terminal TUI with live charts, a swarm-topology diagram and a graded findings stream, both enabled by default. There is also a pentestswarm demo command that replays an entire campaign offline — a sensible first stop for evaluators who want to see the swarm behavior before granting it any target, and pentestswarm docs opens the hosted documentation. The project publishes a full docs site covering quickstart, provider setup, CLI reference and troubleshooting, plus a ROADMAP.md — appropriate scaffolding for a tool at alpha status, which the badge row states explicitly.
The README is candid about lineage, crediting a lineage of prior art: PentestGPT for proving LLMs can pentest, PentAGI for fully autonomous agent architecture, Strix, CAI, HackingBuddyGPT, Shannon, BlacksmithAI and PentestAgent. That honesty is a useful map for anyone tracing the evolution of AI offensive tooling from single-prompt assistants toward orchestrated autonomy, and it situates this project as a synthesis point rather than a from-scratch novelty. The legal disclaimer is thorough and unambiguous: authorized testing, bug bounty programs, CTFs and educational research only, with explicit written permission from the target owner required, and direct reference to the CFAA, the Computer Misuse Act and equivalents.
From a defensive-research perspective, the tool is as interesting as an object of study as it is as an instrument. A defender reading this README learns what an autonomous, evidence-producing attack surface sweep looks like from the outside: many concurrent agents chewing a 1,000-subdomain scope in parallel, pheromone-driven prioritization that keeps fresh findings hot, and report generation that packages proof. Building detection content that distinguishes this behavior from ordinary scanner noise — the concurrency, the rapid re-engagement after new findings, the breadth-first sweep pattern — is exactly the kind of work this documentation informs. Likewise, purple teams can run the bundled labs with --lab --provider ollama entirely locally and instrument their own detection stack against the traffic the swarm generates.
Caveats for a professional adoption decision: the project is explicitly alpha, the exploit-and-prove claims are the authors' own marketing framing rather than independently verified results, and the AGPL license carries integration obligations for anyone embedding it into commercial pipelines. There is also an inherent tension in any autonomous exploitation tool — the same evidence-backed chaining that proves vulnerabilities to a client can cause real impact on fragile production systems, so scope discipline and budget limits are not optional courtesies. Within a properly authorized engagement, a lab environment, or a research harness, Pentest-Swarm-AI represents one of the more architecturally thoughtful entries in the current wave of agentic offensive security tooling, and its swarm-versus-pipeline argument is one every practitioner in this space should be able to articulate.
Armur-Ai/Pentest-Swarm-AI.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.