Security & Testing AI Agents
Compare the best open-source AI agents for security & testing. Scanners, pentest helpers and test automation. Ranked by GitHub stars, with install commands, what each one can touch and scan reports where available.
ConcoLLMic
ConcoLLMic: the first language- and theory-agonistic concolic execution engine via LLM agents
RedteamAgent
An AI red-team agent for authorized labs and web app pentesting workflows. Turns Claude Code / OpenCode / Codex into a structured recon → test → exploit → report workflow, with containerized tools and resumable state.
Divar AI Contest
CTF for AI agents. 1st & 2nd place LLM-agent solutions to Divar's AI Contest on Quera, built on GPT-4.1-mini (via Metis AI) with LangGraph ReAct agents.
Pentestkit
Autonomous multi-agent pentest framework — plans, exploits, verifies (proof-required), CVSS-scores and writes client-ready reports. 104/104 (100%) on the XBOW validation benchmarks, powered by Kimi K3.
PCLA
PCLA: A framework for testing autonomous agents in the CARLA simulator
Threatswarm
27 scope-enforced AI agents that run the full pentest kill-chain (recon → exploit → post-ex → DFIR → report) as a one-command Claude Code plugin. Backed by 754 MITRE-mapped skills.
Spec2case
Spec2Case 是生产级 AI 测试用例生成智能体,支持图片/文本需求理解、人工确认、LangGraph 流程编排和 Excel 用例导出。
AgentWard
AgentWard – Built for all, hardened for OpenClaw.
Autonomous Qa Loop
Portable fresh-agent QA loop prompt for finding bugs without biased self-checks / 通用自动 QA 循环 SKILL
CIRISAgent
CIRIS: an open-source AI assistant with a conscience you can check. Signed, auditable reasoning on every decision, a human-held halt, 29 languages. AGPL-3.0.
Clawmoat
The open-source agent firewall. Prevent AI agents from leaking data, using dangerous tools, and importing poisoned dependencies.
PentestPi
Autonomous Penetration Testing Agent Framework with External State Memory & Anti-False-Falsification Guardrails.
CyberPenda
Local-first pentest agent: Go daemon + React dashboard + Codex/Claude Code/Pi runtimes, scoped projects, Blackboard, sandbox runners
Agenttrust
Enterprise Zero-Trust AI Security & Governance Gateway: Real-Time Prompt Injection Defense, Action Scoping, HITL Approvals, Post-Quantum Merkle Audit & EU AI Act Compliance for Autonomous Agent Swarms.
Toolguard
The "Cloudflare for AI Agents". 7-layer security interceptor, real-time observability dashboard, and automated reliability testing for MCP and AI tool chains. Prevent hallucinations, prompt injection, and destructive tool calls.
Agentegrity
The open standard for AI agent integrity. Evaluate, enforce, and prove that autonomous agents are adversarially coherent, environmentally portable, and verifiably assured.
Intelstrike
AI-powered pipeline that transforms Cyber Threat Intelligence into actionable pentesting test cases using CrewAI and MITRE ATT&CK
List refreshed November 15, 2026. Data comes from public GitHub repositories.