awesome-ai-pentesting - A curated list of AI-powered pentesting tools, fra

项目说明

Awesome AI Pentesting ![Awesome]()

> A curated list of AI-powered tools, frameworks, and resources for penetration testing, bug bounty hunting, red teaming, and cybersecurity operations.

The intersection of Artificial Intelligence and offensi security is e rapidly. This list tracks the most impactful open-source projects that le LLMs, machine learning, and autonomous agents for cybersecurity.

Created by @sky — Cybersecurity & AI Researcher | TryHackMe Top 1% Global

*Stars updated: September 2026*

---

Contents

Autonomous AI Pentesting Agents

MCP Servers for Security

Bug Bounty & Recon AI

CTF Solvers & Challenge Tools

Analysis & Scanning

Red Team & Offensive AI

Blue Team & Defensive AI

AI Security (Securing AI Systems)

Fuzzing with AI/ML

Pentest Report Generation

OSINT with AI

Research Papers & Resources

Contributing

---

Autonomous AI Pentesting Agents

*Fully autonomous agents that perform end-to-end penetration testing tasks with minimal human inter.*

| Tool | Description | AI Tool | Stars |
|------|-------------|---------|-------|
| Strix | Open-source AI hackers that run code dynamically, find , and them through actual proof-of-concepts. | Claude API | !Stars |
| Shannon | Fully autonomous AI hacker using Claude Agent SDK. 96.15% success rate on XBOW Benchmark. Finds and exploits real in web apps. | Claude API (Agent SDK) | !Stars |
| PentAGI | Fully autonomous AI agents system. Docker sandboxed, 20+ built-in tools (nmap, metasploit, sqlmap), Neo4j knowledge graph. | Multi-LLM (OpenAI, Claude, DeepSeek) | !Stars |
| PentestGPT | Automated penetration testing agentic framework powered by LLMs. Published at USENIX Security 2024. | OpenAI API (GPT-4) | !Stars |
| CyberStrikeAI | AI-nati platform in Go combining Eino-powered agents, MCP-nati, RAG knowledge, and human o in one auditable workspace. | Multi-LLM (OpenAI-compatible: OpenAI, DeepSeek, Qwen) | !Stars |
| Decepticon | Autonomous hacking agent for red teaming. Modular multi-agent architecture built on LangGraph with MCP tool integration. | Multi-LLM () | !Stars |
| PentestAgent | AI agent framework for black-box security testing with prebuilt attack playbooks for bug bounty, red-team, and pentest. | OpenAI API (GPT-4) | !Stars |
| Cairn | General-purpose state-space search engine on autonomous penetration testing: given an origin and a goal, it searches for the attack path. | Claude Code, Codex (worker backends) | !Stars |
| CyberStrike | Terminal-based offensi harness with 13+ specialized agents, 7,600+ security skills, and 120+ OWASP test cases. | Multi-LLM (Claude, OpenAI, Gemini, Ollama, Bedrock) | !Stars |
| Pentest-Swarm-AI | Autonomous pentesting with a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning. Bug bounty, monitoring, and CTF modes. | Claude API | !Stars |
| Pentest-AI | AI pentester usable via MCP, CLI, or CI that re-runs each exploit with machine oracles before marking a finding as . | Claude Code, Codex, Ollama/local models | !Stars |
| Pentest Copilot | AI-powered browser-based ethical hacking assistant with agentic architecture that runs commands in the pentest en. | OpenAI API | !Stars |
| NeuroSploit | AI-powered pentest framework with 100 types, isolated Kali containers, 9 specialized agent personas. | Multi-LLM (OpenAI, Claude, Ollama/local) | !Stars |
| LuaN1aoAgent | Cogniti autonomous AI hacker using dual-graph reasoning (causal and attack graphs) for plan-execute-reflect penetration testing. | Multi-LLM (OpenAI, DeepSeek, Claude) | !Stars |
| hackingBuddyGPT | Academic framework for building LLM-dri hacking agents in ~50 lines of code. Research platform with reproducible pri benchmarks. | OpenAI API (GPT-4) | !Stars |
| Xalgorix | Self-hosted autonomous pentesting agents for real-time recon, detection, and exploit- findings with a local web dashboard. | Multi-LLM (OpenAI, Anthropic, DeepSeek, Gemini, Ollama, LiteLLM) | !Stars |
| Nebula | AI-powered pentesting assistant for automating recon, note-taking, and analysis with human decision checkpoints. | OpenAI API (GPT-4) | !Stars |
| Darkmoon | Open source autonomous AI penetration testing platform that orchestrates 80+ offensi through Markdown playbooks and MCP controlled execution, co web, cloud, Acti, Kubernetes and API with an e trail per finding. | Multi-LLM (OpenAI, Anthropic, Ollama/local) | !Stars |
| Cybermes | Offensi and bug bounty agent framework with 200+ playbooks, a native Go MCP server, and a standalone CLI driven by Hermes Agent. | Hermes Agent, MCP clients (Claude, Gemini) | !Stars |
| numasec | Terminal AI security agent that drives your local tools with runbooks, keeps operation context, and tracks findings, e, and reports. | Multi-LLM (OpenAI, Anthropic, Google, OpenRouter, Ollama) | !Stars |
| PentestCode | Multi-agent terminal pentesting agent that runs tools, keeps persistent engagement state, and chains attacks toward a stated goal. | Multi-LLM (20+ pro incl. Claude, OpenAI, Ollama) | !Stars |
| ARTEMIS | ARTEMIS is an autonomous agent created by the Stanford Trinity project to automate discovery. | OpenAI API (GPT-4) | !Stars |
| AIDA | AI-Dri Assessment that connects AI to 400+ pentesting tools via MCP (Exegol container), enabling natural language-dri workflows. | Multi-LLM (OpenAI, Claude, Ollama via MCP) | !Stars |
| Zen-AI-Pentest | Autonomous multi-agent pentest framework integrating 72+ security tools with a React dashboard, REST API, and CLI. | Multi-LLM (DeepSeek, GPT-4o, Claude, Llama) | !Stars |
| BugTraceAI | Open-source multi-agent platform for authorized web application security testing with , e capture, and reporting. | Multi-LLM | !Stars |
| cyber-harness | Single-binary agent runtime for pentest, red team, and bug bounty that bundles scanners, proxy routing, skills, and a source-code audit distribution. | Multi-LLM (OpenAI/Anthropic-compatible, DeepSeek) | !Stars |

MCP Servers for Security

*Model Context Protocol servers that bridge AI assistants with cybersecurity tools.*

| Tool | Description | Stars |
|------|-------------|-------|
| IDA Pro MCP | AI-powered reverse engineering assistant that bridges IDA Pro with LLMs through MCP. | !Stars |
| HexStrike AI | Ad MCP server with 150+ cybersecurity tools. Lets AI agents autonomously run pentesting, vuln discovery, and bug bounty tools. | !Stars |
| Ghidra MCP | Ghidra MCP server with 200+ tools for AI-assisted reverse engineering, a as GUI plugin or headless server. | !Stars |
| Burp Suite MCP Server | Official PortSwigger extension that integrates Burp Suite with AI clients through MCP. | !Stars |
| MCP Scanner | Cisco AI Defense scanner that inspects MCP servers for threats and security findings. | !Stars |
| MCP-Security-Checklist | Comprehensi checklist for MCP-based AI tools by SlowMist. Input , audit capability, and risk assessment. | !Stars |
| mcp-security-hub | 36 MCP servers with 175+ tools: Nmap, Ghidra, Nuclei, SQLMap, Hashcat. Recon, web sec, binary analysis, blockchain, AD. | !Stars |
| JADX MCP Server | MCP server for the JADX-AI plugin enabling LLM-assisted Android APK reverse engineering. | !Stars |
| awesome-mcp-security | Curated collection of MCP security resources: tools, papers, , articles, and information. | !Stars |
| Google Security MCP | MCP servers that give AI clients access to Google Security Operations (Chronicle), Threat Intelligence, and other Google security products. | !Stars |
| pentestMCP | AI-powered penetration testing via MCP. 20+ security assessment tools (Nmap, Nuclei, ZAP, SQLMap) through MCP protocol. | !Stars |
| awesome-cyber-security-mcp | Curated list of MCP servers focused on cybersecurity operations. | !Stars |
| mcp-ser | Open, testable security control standard (MSSS) for certifying MCP servers with levels and e requirements. | !Stars |
| Bolt | Docker-based MCP ser 100+ Kali Linux security tools as plugins. Successor of mcp-for-security. | !Stars |
| PentestThinkingMCP | AI pentesting reasoning engine with Beam Search, MCTS, attack scoring for attack path planning and CTF solving. | !Stars |
| mcp- | Security pentesting MCP Server with 22 tools. Windows/WSL bridge for Kali tools integration with Claude. | !Stars |
| DomScan | Hosted domain intelligence MCP for DNS, WHOIS/RDAP, TLS, subdomains, reputation, email security, and typosquatting. | !Stars |

Bug Bounty & Recon AI

*AI-enhanced tools for reconnaissance and bug bounty automation.*

| Tool | Description | Stars |
|------|-------------|-------|
| Nuclei | Fast scanner with YAML-based DSL. AI-powered template generation via -ai flag. 10k+ community templates. | !Stars |
| Sn1per | Attack surface management platform combining automated scanning with intelligent analysis. | !Stars |
| awesome-bugbounty-tools | Curated list of bug bounty tools including AI-enhanced scanners and recon automation frameworks. | !Stars |
| AutoSploit | Automated mass exploiter combining Shodan/Censys/Zoomeye for target discovery with Metasploit for exploitation. | !Stars |
| Agentic Bug Hunter | AI bug bounty toolkit that runs recon, finding, , and reporting from a CLI or inside Claude Code, with free or subscription AI pro. | !Stars |
| Claude-BugHunter | Claude Code skill bundle for bug hunting and external red teaming: 80+ skills, 15 slash commands, and 681 disclosed-report patterns. | !Stars |
| BigBountyRecon | 58 different techniques using Google dorks and open source tools for initial reconnaissance. | !Stars |
| Mantis | Security framework automating discovery, reconnaissance, and scanning. Chains multiple tools from domain input. | !Stars |
| ReconAIzer | Burp Suite extension using OpenAI GPT to disco, params, URLs, and subdomains during bug bounty recon. | !Stars |
| HackBot | AI-powered cybersecurity chatbot using LLaMA for code analysis, scan analysis, and cybersecurity Q&A. | !Stars |
| Julius | Praetorian's LLM service fingerprinting tool that identifies Ollama, vLLM, LiteLLM, and 60+ AI servers on network endpoints. | !Stars |

CTF Solvers & Challenge Tools

*AI tools for solving Capture The Flag competitions and security challenges.*

| Tool | Description | Stars |
|------|-------------|-------|
| Project Muteki | Multi-agent CTF-solving swarm where a coordinator schedules several CLI agent engines toward a single goal. | !Stars |
| BoxPwnr | Framework for benchmarking LLMs and agentic strategies on HackTheBox, PortSwigger, picoCTF, TryHackMe, and other CTF platforms. | !Stars |
| AI-Goat | Learn AI security through LLM CTF challenges. Run locally, no sign-ups or cloud fees needed. | !Stars |
| EnIGMA | Enhanced Interacti Model Agent. State-of-the-art on NYU CTF and CyBench. 3x more challenges than prior agents. (ICML 2025) | Paper |
| CTFAgent | LLM-powered CTF solver with plan-and-execute paradigm. Outperforms 88% of human CTF participants. | Paper |
| CSAW Agentic CTF | CSAW competition using generati AI to solve CTF challenges. Major academic AI security benchmark. | Competition |
| Cybench | Framework for e LLM agents on 40 professional-level CTF tasks from 4 competitions. | !Stars |
| ChatGPT on CTF | Research testing whether AI-LLMs can solve CTF challenges by running commands in test en. | !Stars |
| LLM-Security-CTF | Learn LLM/AI security through CTF challenges: prompt injection, jailbreaks, guardrail bypass, tool abuse. | !Stars |

Analysis & Scanning

*AI-powered discovery and code analysis tools.*

| Tool | Description | Stars |
|------|-------------|-------|
| SkillSpector | NVIDIA's security scanner for AI agent skills. Detects , malicious patterns, and prompt injection before a skill is installed. | !Stars |
| Semgrep | Lightweight static analysis for finding bugs and enforcing code standards with AI pattern matching. | !Stars |
| Codex Security | OpenAI's CLI and TypeScript SDK for defining security policy and finding, , and fixing in code. | !Stars |
| Garak | NVIDIA's LLM scanner. Probes for hallucination, data leakage, prompt injection, toxicity, and jailbreaks. | !Stars |
| agent-scan | Snyk's security scanner for AI agents, MCP servers and agent skills. Detects prompt injections and tool poisoning. | !Stars |
| | Zero-shot discovery using Claude AI. Analyzes Python call chains. Found 12+ zero-days in production code. | !Stars |
| open-kritt | Self-hosted platform that orchestrates AI agents to find, de-duplicate, rank, and in code. | !Stars |
| Agentic Security | LLM scanner / AI red teaming kit. Protects AI systems from jailbreaks, fuzzing, and multimodal attacks. | !Stars |
| AutoCVE | Agent-driven C pipeline that selects projects, audits source code, , and writes reports. | !Stars |
| LLM SAST Skills | Agent skills that turn Claude Code, Codex, and other coding assistants into a SAST scanner for web and mobile codebases. | !Stars |
| AgentShield | Security auditor for AI agent configurations: hardcoded secrets, permission misconfigs, hook injection, and MCP ser. | !Stars |
| Agentic Radar | Security scanner for agentic systems. Workflow , tool identification, MCP ser, mapping. | !Stars |
| MEDUSA | AI-first security scanner with 40,000+ detection patterns for AI/ML apps, agents, and LLM integrations. | !Stars |
| ModelScan | Scans ML models for unsafe code. Supports H5, Pickle, Sa, and more formats. | !Stars |
| DockSec | OWASP AI-powered Docker security scanner that explains in plain English. | !Stars |
| OpenHack | Agentic security scanner and for codebases that exclusively uses open-source models. | !Stars |
| agentgg | Agentic white-box SAST scanner whose agents follow imports and call graphs to confirm findings before reporting. CI ready. | !Stars |
| NVIDIA Analysis | NVIDIA blueprint for identifying and mitigating container security with generative AI. | !Stars |
| rust-in-peace | Agent-assisted discovery for Rust with ad triage, dynamic , and an experimental Android APK analysis profile. | !Stars |

Red Team & Offensive AI

*Offensive AI tools, ad ML, and AI red teaming frameworks.*

| Tool | Description | Stars |
|------|-------------|-------|
| Promptfoo | LLM red teaming, pentesting, and vuln scanning with 100+ attack types. Tests complete AI systems including RAG and agents. | !Stars |
| Social-Engineer-Toolkit | Open-source penetration testing framework designed for social engineering. | !Stars |
| Caldera | Automated ad emulation platform with AI-dri planning. Originally by MITRE, now an Apache project. | !Stars |
| Ad Robustness Toolbox | IBM's Python library for ML Security: e, poisoning, extraction, inference attacks and defenses. | !Stars |
| llm-attacks | Uni and transferable attacks on aligned language models. Academic research on ad attacks against LLMs. | !Stars |
| PyRIT | Microsoft's Python Risk Identification Tool for red teaming generative AI systems. | !Stars |
| DeepTeam | Framework for red teaming LLMs. 10+ ad attacks, supports OWASP Top 10 for LLMs and NIST AI RMF. | !Stars |
| pentest-ai-agents | 50 Claude Code subagents for authorized penetration testing and offensi research. | !Stars |
| ai-exploits | Collection of real-world AI/ML exploits for responsibly disclosed . | !Stars |
| offensi | Curated list of Offensive AI resources: tools, techniques, research papers, and attack methodologies. | !Stars |
| Anamorpher | Trail of Bits tool for crafting image-scaling attacks that deli prompt injection. | !Stars |
| EasyJailbreak | Python framework to generate ad jailbreak prompts against LLMs. | !Stars |
| OPFOR | Ad emulation for AI agents and MCP servers, usable from the CLI, the IDE, or a browser extension. | !Stars |
| AgentHound | Offensi for agentic infrastructure: recon, credential looting, model exfiltration, and poisoning across MCP, A2A, gateways, and stores. | !Stars |
| Augustus | Praetorian's Go-based LLM scanner with 210+ ad attacks: prompt injection, jailbreaks, encoding exploits, and data extraction. | !Stars |
| Spikee | Re's modular kit for testing LLMs, guardrails, and applications against prompt injection and jailbreaks. | !Stars |

Blue Team & Defensive AI

*AI tools for defense, detection, and incident response.*

| Tool | Description | Stars |
|------|-------------|-------|
| Wazuh | Open-source security monitoring with AI-enhanced threat detection, SIEM, and XDR. | !Stars |
| Sigma | Generic signature format for SIEM systems with AI-powered rule creation. | !Stars |
| Falco | Cloud Nati Security by CNCF. Detects threats across containers, hosts, K8s, and cloud. | !Stars |
| Guardrails AI | Adding guardrails to LLMs. Input/output , content moderation, and PII detection. | !Stars |
| NeMo Guardrails | NVIDIA's toolkit for programmable guardrails on LLM systems. Content moderation, jailbreak detection. | !Stars |
| Redcells | Automated ad testing platform for LLMs you own or control. Runs structured red-team jobs (prompt injection, jailbreak, data leakage, etc.) with iterati→refine layers and per-layer judge scoring via web dashboard or API. | Repo |
| Shuffle | Open-source SOAR platform for security automation and orchestration. | !Stars |
| AiSOC | Self-hostable AI Security Operations Center with alert fusion, LLM-agent triage, and MITRE ATT&CK in. | !Stars |
| Beelzebub | Deception framework for realistic decoys, with LLM-powered responses that sustain attacker interaction. | !Stars |
| GhostWriter | Report management platform for red/blue team operations with AI-assisted analysis. | !Stars |
| AttackGen | Incident response testing tool that uses LLMs with MITRE ATT&CK and ATLAS to generate tailored attack scenarios. | !Stars |
| STRIDE GPT | AI-powered threat modeling tool that generates STRIDE threat models and attack trees for an application. | !Stars |
| numbat | Perplexity's endpoint into AI agent activity, with local detection, optional pre-action blocking, and forensic reconstruction. | !Stars |
| Agent Threat Rules | Open, executable detection rule format for AI agent threats, like Sigma for agents. | !Stars |

AI Security (Securing AI Systems)

*Tools for defending AI/LLM systems against prompt injection, jailbreaks, and emerging threats.*

| Tool | Description | Stars |
|------|-------------|-------|
| Superagent | SDK for AI agent safety: blocks prompt injection, redacts PII and secrets, and runs red team scenarios against agents. | !Stars |
| AI-Infra-Guard | Tencent's full-stack AI red teaming platform that scans agents, skills, MCP servers, and AI infrastructure. | !Stars |
| PurpleLlama | Meta's tools to assess and improve LLM security: CyberSecE, Llama Guard, Prompt Guard, and Code Shield. | !Stars |
| nono | Zero-setup sandbox that isolates AI coding agents (Claude Code, Codex, and more) with fine-grained, policy-controlled permissions. | !Stars |
| ADR | Uber's Agentic AI Detection and Response system for securing employee-facing agents like Cursor, Claude Code, and Codex. MLSys 2026. | !Stars |
| Pipelock | AI agent firewall that inspects HTTP, WebSocket, MCP, and A2A traffic for secret exfiltration and prompt injection. | !Stars |
| API Relay Audit | Local CLI auditing third-party AI relays and LLM proxies for prompt-injection signals, package-command text changes, error-response leakage, and Anthropic SSE anomalies, with Markdown reports. | !Stars |
| Arcanum PI Taxonomy | Interacti of prompt injection and LLM attacks for pentesters moving into AI red teaming. | !Stars |
| awesome-mcp-security | Collection of MCP security resources: , tools, papers, and mitigation strategies. | !Stars |
| ZeroLeaks | CLI that red-teams LLM system prompts and agent instructions for prompt injection and extraction. | !Stars |
| prompt-injection-defenses | Every practical and proposed defense against prompt injection attacks. Comprehensi. | !Stars |
| Open-Prompt-Injection | Toolkit and benchmark for implementing and e prompt injection attacks and defenses. | !Stars |
| mcp-context-protector | Trail of Bits security wrapper for untrusted MCP servers: config pinning, line-jumping and tool-poisoning protection. | !Stars |
| Awesome-LLMSecOps | LLM Security Operations in one repo. Curated links co the full LLMSecOps lifecycle. | !Stars |
| parry-guard | Prompt injection scanner for AI coding tools (Claude Code, Codex). Runs DeBERTa/Llama transformers locally in Rust or ONNX. | !Stars |

Fuzzing with AI/ML

*Machine learning-guided fuzzing and automated test generation tools.*

| Tool | Description | Stars |
|------|-------------|-------|
| AFL++ | Superior fork of AFL with ML-guided mutation strategies. Industry standard for fuzzing. | !Stars |
| Buttercup | Trail of Bits' Cyber Reasoning System for DARPA AIxCC. Finds with fuzzing and patches them with LLMs. | !Stars |
| FuzzyAI | CyberArk's automated LLM fuzzing tool for finding jailbreaks and security in LLM APIs. | !Stars |
| OSS-Fuzz-Gen | Google's LLM-powered fuzzing . Generates fuzz targets for C/C++. 29% max line co increase. | !Stars |
| E | First open-source AI-driven tool for system-level test generation. E algorithms for REST, GraphQL, RPC. | !Stars |
| Atlantis | Team Atlanta's Cyber Reasoning System from the DARPA AIxCC Final Competition for automated discovery. | !Stars |
| OSS-CRS | OpenSSF framework for building and running LLM-based autonomous bug-finding and bug-fixing systems. | !Stars |
| ToolFuzz | First framework for testing LLM agent tools. Combines fuzzing with LLMs for correctness e. | !Stars |

Pentest Report Generation

*AI tools for automated penetration testing report creation.*

| Tool | Description | Stars |
|------|-------------|-------|
| PwnDoc | Pentest report generator for findings and customizable Docx reports with templates. | !Stars |
| SysReptor | Customizable pentest reporting platform with AI-assisted writing and finding descriptions. | !Stars |
| APTRS | Automated Pentest Reporting System. Python/Django-based. PDF/Excel generation, project tracking. | !Stars |
| Faction | Pen test report generation and assessment collaboration platform. | !Stars |

OSINT with AI

*AI-powered Open Source Intelligence tools.*

| Tool | Description | Stars |
|------|-------------|-------|
| Sherlock | Hunt down social media accounts by username across 400+ social networks. | !Stars |
| SpiderFoot | Automated OSINT platform. 200+ data sources, threat surface mapping, most modules need no API keys. | !Stars |
| GHunt | Offensi framework for OSINT. | !Stars |
| theHar | E-mails, subdomains and names har for OSINT. | !Stars |
| Recon-ng | Full-featured web reconnaissance framework with modular design. | !Stars |
| OpenOSINT | AI-powered OSINT agent with 20 tools, usable as an interactive REPL, MCP server, CLI, or web interface. | !Stars |
| Taranis AI | Ad OSINT tool using NLP-powered news collection and AI for situational analysis. | !Stars |
| OSINTGPT | OSINT analysis tool le GPT embeddings and search for document similarity. | !Stars |

Research Papers & Resources

Papers

PentestGPT: An LLM-empowered Automatic Penetration Testing Tool — USENIX Security 2024

LLM Agents can Autonomously Hack Websites — GPT-4 hacks 73% of test websites

Getting pwn'd by AI: Penetration Testing with LLMs — Systematic study

AutoAttacker: LLM Guided Automatic Cyber-attacks — Autonomous attack systems

EnIGMA: Enhanced Interacti Model Agent for CTF — ICML 2025

LLM Agents can Autonomously Exploit One-day — GPT-4 exploits 87% of 15 real-world one-day C the description

Teams of LLM Agents can Exploit Zero-Day — HPTSA: hierarchical planning with task-specific agents

Cybench: A Framework for E Cybersecurity Capabilities and Risks of Language Models — 40 professional-level CTF tasks

Comparing AI Agents to Cybersecurity Professionals in Real-World Penetration Testing — ARTEMIS vs. 10 professionals on a ~8,000-host network

Awesome Lists

| List | Description | Stars |
|------|-------------|-------|
| awesome-pentest | General pentesting resources. | !Stars |
| Awesome-GPT-Agents | GPT agents for cybersecurity: offensi, and analytical. | !Stars |
| Awesome-LLM4Cybersecurity | LLMs for cybersecurity: pentesting reasoning, exploit generation, detection. | !Stars |
| awesome-llm-security | Tools, documents, and projects about LLM Security. | !Stars |
| awesome-ai-security-tools | Public-source, research, and commercial tools for AI security and AI-assisted cybersecurity. | !Stars |
| AI-Red-Teaming-Guide | Guide to ad testing and security e of AI systems. | !Stars |
| Awesome-AI-Hacking-Agents | List of AI hacking agents. | !Stars |
| awesome-cybersecurity-agentic-ai | Autonomous security agents, frameworks, and research. | !Stars |
| awesome-skills-security | Curated skill set of security-focused Claude Code skills. | !Stars |
| Awesome-Offensi | Open-source projects, papers, benchmarks, and commercial solutions in offensi AI. | !Stars |
| awesome-ai-cybersecurity | Resources for AI in cybersecurity. Collection for professionals and researchers. | !Stars |

Standards & Frameworks

OWASP AI Security and Privacy Guide

MITRE ATLAS — Ad Threat Landscape for AI Systems

OWASP Top 10 for LLM Applications

OWASP Top 10 for Agentic Applications

NIST AI Risk Management Framework

---

Contributing

Contributions welcome! Please read CONTRIBUTING.md before submitting a PR.

Criteria for Inclusion

Open-source with a GitHub repository

Uses AI/ML in a meaningful way for security

Actively maintained (commits within 12 months)

Has documentation

---

Disclaimer

Tools listed are for educational purposes and authorized security testing only. Always obtain proper authorization before testing systems you do not own. The maintainers are not responsible for misuse.

---

<p align="center">
<i>Created by <a href="
_{If this list helped you, consider giving it a star!}
</p>

项目信息

开发语言：未知

Star 数：66

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of AI-powered pentesting tools, frameworks, MCP servers, and resources for autonomous cybersecurity operations展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。