Radar / AI security / Shannon
Shannon: open-source AI pentester that reports only vulnerabilities it can actually exploit
CLI agent that combines source-code analysis with live exploitation against web apps and APIs under a 'no exploit, no report' rule; version 3.5.0 is out, with CI/CD integrations and PDF, Markdown and SARIF reporting, at 50k stars.
Why it matters
Closes the gap between shipping cadence and pentest cadence: exploitation-backed testing against staging on every build, at model cost, instead of a multi-thousand-dollar scan every few months.
What you could build with it
A startup shipping weekly could add Shannon to CI so every staging deploy gets an exploitation-backed security pass, failing the build only on proven high-severity findings.
Does it hold up?
Proven in the sense that it runs locally via npx with CI gates and SARIF output, but effectiveness claims come from the vendor's own Photoview comparisons; independent benchmarks are still thin, and it must only run against systems the operator owns.
Built with Shannon
- Shannon: autonomous AI pentester for web apps and APIsblog · Project page describing the open-source agent, npx quick start, CI integrations, and the rule that only exploited findings are reported.
- Shannon 3.0 AI pentester gets through Aikido and XBOWblog · Coverage of the 3.0 release, its multi-stage code analysis pipeline, and its self-scored Photoview comparison against Aikido and XBOW.
- Keygraph releases Shannon v3.5.0 open-source AI pentesternews · Report on the 3.5.0 release, 49.5k stars at the time, CI severity gates, and the warning to run it only against systems the operator owns.
- KeygraphHQ/shannon-actiongithub · Official GitHub Action that runs Shannon scans inside CI and can fail a build on proven findings above a chosen severity.
Learn more
First spotted on github: source.
More AI security
NVIDIA SkillSpector: security scanner for AI agent skills, trending againNVIDIA's open-source SkillSpector scanner is trending on GitHub today: it audits AI agent skills before installation…security · JEV 0.75Anthropic sandbox-runtime: OS-level sandboxing for AI agents, no containers requiredAnthropic's sandbox-runtime (srt) is trending with developers this week: an open-source tool that wraps any process in…security · JEV 0.45VoidAccess: open-source, self-hosted dark web OSINT platformSelf-hosted dark-web OSINT platform (892 stars) that takes automated threat intelligence from query to a graph…security · JEV 0.42PlugVetAn independent public directory that grades AI agent skills, plugins, and MCP servers with evidence-backed hygiene…security · JEV 0.42Cisco Project Quarry: open-source behavior detection engine for AI agentsCisco open-sourced Project Quarry on 28 Oct 2026: a behavior detection engine that watches AI agents at the session…security · JEV 0.421Password for Agents: personal AI agents sign in without ever seeing the password1Password launched 1Password for Agents on Oct 22, 2026: when a supported personal agent hits a sign-in page, it…security · JEV 0.39
Get the week's best AI launches, plus 3 ideas worth building
One email every Saturday. Ranked by traction, not hype. Free.