hackagent - HackAgent is an open-source security toolkit to de

项目说明

<di="center">
<p align="center">
<img src=" alt="HackAgent - AI Agent Security Testing Toolkit" width="800">
</p>

<strong>AI Security Red-Team Toolkit</strong>

<br>

App -- Docs -- API


<br>

<br>

!Python
!License
!uv
![Commitizen]()
!Ruff
!Test Co
!CI Status
</div>

What is HackAgent?

HackAgent is a comprehensi SDK and CLI designed to help security researchers, de, and AI safety practitioners e and strengthen the security of AI agents.

As AI agents become more powerful and autonomous, they face security challenges that traditional testing tools cannot address:

| Threat | Description |
|--------|-------------|
| Prompt Injection | Malicious inputs that hijack agent behavior |
| Jailbreaking | Bypassing safety guardrails and content filters |
| Goal Hijacking | Manipulating agents to pursue unintended objectives |
| Tool Misuse | Exploiting agent capabilities for unauthorized actions |

HackAgent automates testing for these using research-backed attack techniques, helping you identify and fix security issues before they are exploited.

<di="center">
<img src="docs/static/gifs/terminal.gif" alt="HackAgent CLI Demo" width="100%" />
<p><em>Interactive TUI with real-time attack progress and reporting.</em></p>
</div>

Get Started Now

Quick Install

No API key required: HackAgent works locally out of the box.

Standalone binary (no Python required)

Every GitHub Release ships a
self-contained archive per platform:

| Platform | Asset |
|----------|-------|
| Linux x86_64 | hackagent-<>-linux-x86_64.tar.gz |
| macOS arm64 | hackagent-<>-macos-arm64.tar.gz |
| macOS x86_64 | hackagent-<>-macos-x86_64.tar.gz |
| Windows x86_64 | hackagent-<>-windows-x86_64.zip |

Extract the archive and run the hackagent launcher inside it — no Python, pip
or uv install needed. Keep the extracted folder intact; the launcher loads the
libraries next to it.

> Note: the WEB provider drives a real browser through Playwright, whose
> browser binaries cannot be embedded in the archive (or in the PyPI package).
> Before using hackagent web-based targets, install them once with
> playwright install.

Questions? Join community discussions or email .

Architecture

HackAgent uses a modular pipeline to test agent robustness end-to-end.

| Component | Description |
|-----------|-------------|
| Attack Engine | Orchestrates attacks using Ad, AutoDAN-Turbo, PAIR, TAP, FlipAttack, BoN, h4rm3l, CipherChat, PAP, and Static Template |
| Generator | LLM role that creates ad prompts to test the target agent |
| Judge | LLM role that e whether attacks bypass safety measures |
| Target Agent | Your AI agent under test across supported frameworks |
| Datasets | Pre-built benchmark presets plus custom HuggingFace/file/URL JSON datasets |

Supported Frameworks

![Google ADK]()
![OpenAI SDK]()
![LiteLLM]()
![LangChain]()

Reporting

HackAgent supports both local and remote reporting.

hackagent web serves the HackAgent dashboard — the same app as
app.hackagent.dev — from your own machine, against
your cloud data when an API key is configured and against the local SQLite
database (read-only) when it is not. Your API key stays in the CLI process and
is ne to the browser.

Install it with pip install 'hackagent[web]'; see the web command docs for modes and options.

Responsible Use

HackAgent is designed for authorized security testing only. Always obtain explicit permission before testing any AI system.

Do

Don't

Read the full guidelines: Responsible Disclosure

Contributing

Contributions are welcome. See CONTRIBUTING.md and CODE_OF_CONDUCT.md.

License

Licensed under Apache-2.0. See LICENSE.

Disclaimer

HackAgent is intended for security research and AI safety impro. The authors are not responsible for misuse.

项目信息

开发语言：Python

Star 数：520

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕HackAgent is an open-source security toolkit to detect vulnerabilities of your AI Agents展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。