[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f33iuf9wh1gfr9":3},{"code":4,"message":5,"data":6,"timestamp":33},10000,"success",{"full_name":7,"position":8,"description":9,"language":10,"stars":11,"forks":12,"stars_gained":13,"age_days":14,"hn_threads":15,"one_liner":16,"summary_md":17,"topic":18,"github_topics":21,"license":29,"homepage":30,"updated_at":31,"history":32},"Armur-Ai\u002FPentest-Swarm-AI",12,"Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go and 7+ native security tools.","Go",3047,559,497,942,[],"An open-source, self-hosted alternative to XBOW that runs a swarm of LLM agents to find and prove web\u002FAPI vulnerabilities.","## The problem\n\nAutomated pentesting has long meant either scanners that dump unverified \"maybes\" or a human tester grinding through a scope by hand. Recently a hosted service, XBOW, showed that LLM agents can actually top bug-bounty leaderboards, but it is closed, single-agent, cloud-only, and priced accordingly. Pentest Swarm AI is an open, self-hosted attempt at the same job: many agents coordinate over a shared blackboard, take recon findings through classification into exploitation, capture evidence, and write a report.\n\n## What's different\n\nMost \"multi-agent\" security tools are pipelines: one planner LLM dispatches recon, then classification, then exploitation, then report, in a fixed order. The README is explicit that this project rejects that shape in favor of swarm primitives — stigmergy (agents read and write findings on a shared board, with decaying \"pheromone\" weights), emergence (chains form from board state rather than a script), and per-agent trigger predicates. The other real difference is deployment posture: unlike XBOW and similar hosted offerings, you bring your own model (Claude, any OpenAI-compatible endpoint, or local Ollama\u002FLM Studio) and run it on your own infrastructure. A third is the bundled vulnerable labs (crAPI, Juice Shop, VAmPI, DVGA) for legal dry runs.\n\n## Who it's for\n\nPractising pentesters who need breadth across a large scope, bug-bounty hunters working fresh targets, and red teamers who want broad coverage fast — provided they are comfortable with an alpha-status tool and can supervise it. It is not for teams that need a vetted, supported commercial product, nor for anyone without written authorization over the targets; the README's legal disclaimer is blunt for good reason. If you want a single-agent assistant that helps you think through a target, this is more machinery than you need.\n\n## Cost of adoption\n\nGo 1.24 plus 7+ native security tools, with Docker used for the bundled labs. One install path is `npm install -g @armurai\u002Fpentestswarm`, and there are also curl, Homebrew, `go install` and Docker routes. You must supply an LLM provider key or a local model, so running cost is your inference bill (zero for local, but then your hardware and throughput are the limit). The license is AGPL-3.0, which matters if you plan to embed or resell it. The status badge says alpha, and the README is heavy on positioning and light on benchmark evidence — treat its exploitation claims as unproven until you reproduce them.\n\n## Verdict\n\nThis is a roughly two-and-a-half-year-old repository whose monthly Go board appearance (+512 stars, #12) suggests interest is currently accelerating rather than a brand-new spike, though it has never reached the daily trending board and has no Hacker News discussion. The architecture argument against pipeline-style agents is coherent, and the self-hosted, bring-your-own-model angle is a genuine differentiator. The caveats are real: alpha status, AGPL, and a README that sells harder than it substantiates. Worth an afternoon against the bundled labs if you do offensive security; not yet something to point at a client's production scope unsupervised.",{"slug":19,"name":20},"security","Security & Privacy",[22,23,24,25,26,27,28],"ai-agents","bug-bounty","cybersecurity","offensive-security","penetration-testing","penetration-testing-framework","penetration-testing-tools","AGPL-3.0",null,"2026-10-24T21:06:10Z",[],1792890836]