Pentest Swarm AI

Autonomous penetration testing using a swarm of AI agents. Orchestrates recon, classification, exploitation, and reporting specialists with ReAct reasoning — supports bug bounty, continuous monitoring, and CTF modes. Built with Go, Claude API, and 7+ native security tools.

Generate Convert Improve

Install / Use

npx skills add Armur-Ai/Pentest-Swarm-AI

Installs into whichever agent you are using.

About this skill

Quality Score

0/100

README

<h1 align="center">Pentest Swarm AI</h1> The first open-source pentesting tool built on a real swarm — not just multiple agents in a row. <a href="#quick-start">Quick Start</a> · <a href="#what-makes-this-a-swarm">Swarm vs. Multi-Agent</a> · <a href="#how-the-swarm-works">How It Works</a> · <a href="#comparison">Compare</a> · <a href="IMPLEMENTATION_PLAN.md">Roadmap</a> <img src="https://img.shields.io/github/stars/Armur-Ai/Pentest-Swarm-AI?style=for-the-badge&color=f59e0b" alt="Stars"> <img src="https://img.shields.io/badge/Go-1.24-00ADD8?style=for-the-badge&logo=go" alt="Go"> <img src="https://img.shields.io/badge/License-AGPL%203.0-blue?style=for-the-badge" alt="License"> <img src="https://img.shields.io/badge/AI-Claude%20%7C%20Ollama-purple?style=for-the-badge" alt="AI"> <img src="https://img.shields.io/badge/status-alpha-orange?style=for-the-badge" alt="Status">  <img src="docs/demo-flashy.gif" alt="Pentest Swarm AI — live campaign demo" width="900"> <img src="banner/pentest-swarm-ai-banner.gif?v=3" alt="Pentest Swarm AI architecture" width="800">

Built for the Mythos era

Anthropic's Claude Mythos — released through Project Glasswing in April 2026 — surfaced thousands of zero-days across every major operating system and browser. Frontier reasoning has crossed a threshold; the bottleneck is no longer the model.

Pentest Swarm AI is the toolchain a model like that needs to operate. Live access to nmap, sqlmap, Burp, ZAP, Metasploit, and the rest of the offensive stack. Multi-agent coordination through a stigmergic blackboard. Evidence capture, dedup, submission-ready reports. Wire in the model of your choice today — Claude Sonnet, Opus, Llama, anything OpenAI-compatible — and swap in Mythos the day access opens.

Not affiliated with Anthropic. Mythos and Glasswing are Anthropic projects.

Credits & Inspiration

This project stands on the shoulders of giants. We credit and thank these projects for pioneering AI-powered offensive security:

PentestGPT — the OG that proved LLMs can pentest

PentAGI — fully autonomous agent architecture

Strix — AI hackers that find and fix vulns

CAI — cybersecurity AI framework, 3600x faster than humans

HackingBuddyGPT — LLM hacking in 50 lines of code

Shannon — white-box AI pentester

BlacksmithAI — multi-agent pentest framework

PentestAgent — black-box AI security testing

Pentest Copilot — AI-driven pentest agent

Their open-source contributions made tools like this possible.

Legal Disclaimer: Pentest Swarm AI is designed exclusively for authorized security testing, bug bounty programs, CTF competitions, and educational research. You must obtain explicit written permission from the target system owner before running any scan. Unauthorized access to computer systems is illegal under the Computer Fraud and Abuse Act (CFAA), the Computer Misuse Act, and equivalent laws worldwide. The authors and contributors of this project accept no liability for misuse, damage, or any illegal activity conducted with this tool. By using this software, you agree that you are solely responsible for ensuring your use complies with all applicable laws and regulations. Do not use this tool against systems you do not own or have explicit authorization to test.

What makes this a swarm?

Most "multi-agent" pentesting tools are a single planner LLM dispatching to specialist agents in a fixed order — recon → classify → exploit → report. That's a pipeline, not a swarm.

Pentest Swarm AI is built around three swarm-intelligence primitives:

Stigmergy — agents coordinate by reading and writing findings on a shared blackboard, not by a central planner telling them what to do. A finding's pheromone weight biases other agents toward it and decays over time, so stale paths die naturally.
Emergence — attack chains appear that no single agent planned. A recon finding wakes the classifier; a high-severity classification wakes the exploit agent; exploit results feed back into the board and wake the report agent. Order isn't prescribed — it emerges from the blackboard state.
Decentralization — each agent runs its own trigger predicate. Add a new agent with its own predicate and it joins the swarm without anyone rewriting the orchestrator.

We built this because the category was empty. Every tool marketed as "swarm" was actually a pipeline. If you find a counter-example, open an issue — we'll add them to the comparison table.

See IMPLEMENTATION_PLAN.md for the technical deep-dive on stigmergy, pheromone decay, the Postgres-backed blackboard, and why we didn't build on Google ADK / CrewAI / AutoGen.

Quick Start

# Install (pick one)
brew install Armur-Ai/tap/pentestswarm            # macOS (Homebrew tap)
docker run --rm -e ANTHROPIC_API_KEY=sk-ant-... \
  ghcr.io/armur-ai/pentestswarm:latest \
  scan example.com --scope example.com             # Docker one-liner
go install github.com/Armur-Ai/Pentest-Swarm-AI/cmd/pentestswarm@latest  # Go

# One API key, one command, one swarm.
export PENTESTSWARM_ORCHESTRATOR_API_KEY=sk-ant-your-key-here
pentestswarm scan example.com --scope example.com --swarm --follow

That's the whole setup. No Ollama, no model download, no GPU — just a Claude API key.

Running inside a GitHub Actions workflow? There's an action for that — see deploy/github-action/example-workflow.yml.

How the swarm works

                         YOU
                          |
                   pentestswarm scan example.com --swarm
                          |
               ┌──────────▼──────────┐
               │   SEED: TARGET_REG  │
               └──────────┬──────────┘
                          ▼
     ┌────────────────────────────────────────────────────────┐
     │              SHARED BLACKBOARD (pgvector)              │
     │                                                        │
     │   SUBDOMAIN · PORT_OPEN · HTTP_ENDPOINT · TECHNOLOGY   │
     │   CVE_MATCH · MISCONFIGURATION · EXPLOIT_CHAIN         │
     │   EXPLOIT_RESULT · CAMPAIGN_COMPLETE                   │
     │                                                        │
     │   (each finding has a pheromone weight that decays)    │
     └──┬─────────────┬─────────────┬─────────────┬───────────┘
        │             │             │             │
        │ triggers:   │ triggers:   │ triggers:   │ triggers:
        │ TARGET_REG  │ raw recon + │ CVE_MATCH   │ CAMPAIGN_
        │             │ pheromone>  │ pheromone>  │ COMPLETE
        │             │ 0.2         │ 0.5         │
        ▼             ▼             ▼             ▼
   ┌─────────┐  ┌─────────┐   ┌─────────┐   ┌─────────┐
   │  RECON  │  │CLASSIFY │   │ EXPLOIT │   │ REPORT  │
   │         │  │         │   │         │   │         │
   │ runs 8  │  │ maps    │   │ builds  │   │ queries │
   │ tools,  │  │ CVEs,   │   │ attack  │   │ board   │
   │ writes  │  │ scores  │   │ chains  │   │ →md/    │
   │ per     │  │ CVSS,   │   │ per     │   │ html/   │
   │ finding │  │ writes  │   │ finding │   │ json/   │
   └─────────┘  └─────────┘   └─────────┘   │ sarif   │
                                            └─────────┘

Key behaviours:

Agents are independent. Any one of them can be removed, replaced, or added without rewiring the others.
Pheromones decay per-finding-type. A PORT_OPEN stays hot for hours; a SESSION for minutes. Config-driven half-lives.
Scope is enforced at the tool layer and again at the executor. Defence in depth — --scope is not bypassable.
Cleanup is always registered before execution. SIGINT, crashes, and budget exhaustion all trigger reverse-order cleanup. See internal/pipeline/cleanup_memory.go and cleanup.go.
Prompt caching on Claude cuts cost and latency on repeated system prompts (enabled by default for recon + classifier).

Comparison

How we position vs. the rest of the ecosystem. We'll ship real benchmark numbers in a future release (see Phase 3.3).

| Tool | Architecture | Executes vs. suggests | Memory | Tools wired | MCP | Swarm? | |---|---|---|---|---|---|---| | Pentest Swarm AI | Stigmergic blackboard | Executes | pgvector + pheromones | 8 ProjectDiscovery + nmap; sqlmap / Burp MCP / Metasploit in roadmap | Yes | ✅ real | | PentestGPT | Single-agent ReAct | Suggests | None | None native | No | No | | HackingBuddyGPT | Single-agent | Executes | Run logs | Shell passthrough | No | No | | PentAGI | 4 agents + planner | Executes | pgvector | 40+ via MCP/shell | Partial | Pipeline | | Shannon | White-box + browser | Executes | Ses