Week of 5 to 12 October 2026
26 of the 82 tools shipped changes last week, across 1132 commits and 31 releases. None left.
Last Week's Highlights
- PurpleAILAB/Decepticon: The reverser can start a dedicated REA 6.3.0 and Ghidra 12.1.4 workload to analyze binaries already in the engagement workspace, saving the original Evidence bundle with a SHA-256 manifest under .analysis/rea.
- samugit83/redamon: Redamon now detects serialized-object deserialization candidates and can run an agent skill to confirm them, ranking each candidate with a Jev score and surfacing it as a card in AI in Pipeline.
- KeygraphHQ/shannon: Shannon's preflight step now runs an exploit-readiness probe and supports a --validate-auth mode, and it refreshes its suggested models.
0xSteph/pentest-ai
v1.5.0, 2 commits
Scope enforcement now applies on every engagement path, including default start, campaigns, authenticated scans, resume, retest, live, and the agent loop, where before it only ran on the playbook path. A pre-engagement preflight shows what is in and out of scope along with risk settings for auto-auth, strict-scope, and OAST, and asks for confirmation before any traffic, skippable with --ci, --yes, or a non-TTY stdin. New flags --scope-allow, --scope-exclude, --scope-file, and --strict-scope control scope directly, and confirmed scope persists across resume and retest so exclusions cannot be silently widened. ptai bounty import turns a HackerOne, Bugcrowd, Intigriti, or YesWeHack scope into a scope file for ptai start, and ptai bounty report writes a platform-ready Markdown submission with reproducible curl, CVSS, CWE, OWASP mapping, and a replayable proof capsule for each verified finding. SARIF export no longer crashes, and ptai report -f json with -o now works as documented.
AIPentest/CyberStrikeAI
v1.7.22 to v1.7.23, 108 commits
CyberStrikeAI can now create an isolated retest conversation branch directly from a finding in the vulnerability list, inheriting the original conversation history and model context for multiple rounds of fix verification, then update the finding's status and save verification evidence. Payload generation now validates callback hosts before generating payloads. Nmap scans now preserve script arguments when scan options are selected. REST endpoints now normalize missing deletes and empty list responses instead of returning errors. Interception rule saves now reject stale concurrent edits. CyberStrikeAI can update itself in one action from a configurable update source, defaulting to the official repository, with an automatic restart and page recovery afterward.
Armur-Ai/Pentest-Swarm-AI
4 commits
Pentest-Swarm-AI runs against AWS Bedrock as an LLM provider. The swarm now fingerprints web technology through a new whatweb adapter. The Claude client now enforces an HTTP request timeout, so a hung request no longer blocks a run indefinitely.
KeygraphHQ/shannon
v3.4.0, 14 commits
Shannon's preflight step now runs an exploit-readiness probe and supports a --validate-auth mode, and it refreshes its suggested models. The PDF report links finding IDs directly to their detail sections and lays out its cover with the Keygraph wordmark linked to the Keygraph site. Task formation during reconciliation now runs against the live repo instead of a copy, which changes what the reconciliation step can see while planning tasks. Capella research timeouts increase to four hours. Pi agent sessions now run at a high thinking level.
LaurieWired/GhidraMCP
2.0, 3 commits
GhidraMCP now runs in headless mode, so you can drive Ghidra analysis without the GUI attached. Setting a function prototype with set_function_prototype also applies the function name, instead of leaving it unset. The bridge no longer depends on Python, removing that setup step before you connect a client. The underlying Ghidra version is now 12.1.4.
NVIDIA/SkillSpector
198 commits
SkillSpector now classifies executable source surfaces in Python skills and detects network sinks opened through inline urllib openers. Static-YARA rule files that get dropped now surface as a scan error instead of being reported as a completed scan. The taint analyzer no longer fires a propagating assignment more than once, walks the AST in source order, and makes source detection independent of visit order. Analyzer fixes remove false positives for defensive language in skill installers, Bitcoin payment prose flagged as ransomware, Python comments describing program output, and ignore-file entries previously read as credential access. Baseline comparisons now preserve exact findings instead of altering protected baseline output. Opencode scans now redact credentials across overlapping spans without truncating them.
NVIDIA/garak
19 commits
The DAN probes send prompts that match the DAN format again after a compatibility regression. Promptinject probe settings now stay aligned with the prompts actually sampled during a run. The ApiKey detector scopes its safe-token suppression to the credential that matched, so a safe token from one key no longer suppresses findings tied to another. Buff._derive_new_attempt now deep-copies mutable attempt state, so buffs no longer leak or share state across attempts. Generator requests now respect parallel_capable, so generators that cannot run in parallel are no longer sent concurrent requests. The WebSocket generator reuses its event loop across calls instead of creating one per call, running serially.
PurpleAILAB/Decepticon
v1.2.4 to v1.3.1, 25 commits
The reverser can start a dedicated REA 6.3.0 and Ghidra 12.1.4 workload to analyze binaries already in the engagement workspace, saving the original Evidence bundle with a SHA-256 manifest under .analysis/rea. REA tool selection now works cleanly with Gemini, choosing rea_status, rea_find_tools, and rea_call_tool. Decepticon ported 30 capabilities, adding 69 tools and six middleware components. OPPLAN instructions are now centralized in shared middleware, with unified DAG IDs and validated ATT&CK annotations, and legacy OPPLAN tools are removed. Report tool calls are now bound to their current graph partition. The CLI distinguishes invalid model tool calls from empty responses and reports session lookup failures accurately. OSS now exposes the production LiteLLM model routes currently in use.
Tencent/AI-Infra-Guard
v4.6.5, 19 commits
Agent-scan can transform SSE responses with custom transforms, and mcp-scan negotiates modern or legacy protocol versions automatically, recording which version was used. Agent-scan adds OrcaRouter as a provider, and model calls can send extra headers and body fields to the API. DeepTeam can resume an interrupted red team run. Vulnerability rule data now includes 271 new CVE rules and 14 new fingerprints from the September 25 and October 2 updates. Mcp-scan retries LLM calls with rate-limit awareness, and streaming responses in mcp-scan and agent-scan no longer stall indefinitely. Findings survive context compaction, SARIF output keeps remediation text, agent-scan handles the mcp 2.0 input_schema field, and skill-scan keeps fallback tool-call parameters with their own call.
berylliumsec/nebula
nebula-v3.0.7 to nebula-v3.0.8, 199 commits
The LAN Intruder fix corrects payload provenance so payloads are correctly attributed, and mobile access to Target is restored. Mission supervisors can now assign capabilities to child conversations, letting delegated subagents carry out scoped project tasks across nested conversations. Chat subagents run through harness runtimes, and harness deletions no longer fail silently. The built-in assistant can navigate the app, apply settings actions, and switch a project's command execution mode directly from chat. Settings now shows provider and harness usage accounting. Project switching reuses the workspace bootstrap and runs faster, and project notes autosave with a visible save recovery state.
cisco-ai-defense/mcp-scanner
v4.8.6, 2 commits
A version bump and a litellm dependency bump for a CVE fix. Nothing changed in the tool.
cisco-ai-defense/skill-scanner
2.2.1 to 2.2.2, 16 commits
Skill Scanner now flags whole process-environment value dumps in Python, JavaScript/TypeScript, and shell code as DATA_EXFIL_ENV_DUMP, while leaving targeted reads, keys-only enumeration, and comments below the HIGH boundary. The scanner bounds TAR extraction the same way it already handled ZIP, checking member count, declared size, compression ratio, path traversal and links before writing anything, and raises ARCHIVE_ZIP_BOMB on archives over the limit instead of expanding them silently. PG_PII_CREDIT_CARD no longer matches digits inside decimal fractions. Markdown reports no longer leak incomplete code fences into surrounding findings, and SARIF artifact URIs are now percent-encoded so paths with reserved or non-ASCII characters resolve correctly. Regex work on scripts padded with long blank-line runs and on crafted Markdown links no longer runs in quadratic time. The adjudicator disables reasoning by default so short verdicts aren't cut off, overridable via SKILL_SCANNER_ADJUDICATOR_LLM_REASONING_EFFORT, with output length set by SKILL_SCANNER_ADJUDICATOR_LLM_MAX_TOKENS. The Homebrew formula installs cleanly again without the unused rust dependency.
dreadnode/ares
3 commits
Three dependency bumps. Nothing changed in the tool.
elementalsouls/Claude-BugHunter
8 commits
Nothing changed in the tool last week. The commits were star history chart refreshes and a sponsor link swap in the docs.
google/mantis
11 commits
Mantis adds a dependency gate and skills integrity check, catching risky dependencies and tampered skill definitions. The tool now names C++ class members declared through field-less declarators. record_threat_model now accepts structured threat entries. Gate findings now match exactly when the path names a real file. CLI overrides are now one-shot, and a bad --path-root causes a hard failure. The pause banner's resume command carries the same one-shot overrides forward. Mantis stops retrying model calls that fail with 4xx errors.
h5i-dev/h5i
v0.4.9 to v0.5.0, 27 commits
The install script now puts h5i into ~/.local/bin by default, without requiring sudo, and falls back to a user directory when sudo refuses. The h5i app extract command now writes the schema's Lean output whenever the schema flag is set to true.
microsoft/PyRIT
111 commits
PyRIT adds a KnownBadSignatureScorer that flags EICAR, GTUBE and GTphish test signatures, plus a new file write surface scorer. Dataset loaders now cover the CyberSecEval MITRE benchmark and Anthropic's model-written evals, and a new Garak ProPILE scenario tests for privacy leakage. The GUI adds dataset catalog navigation with cards, paginated seed browsing, and a runtime Techniques registry. TAP attacks now score against the objective score instead of an auxiliary one. GandalfScorer reads a "no password" reply as a token rather than requiring an exact string match. The BeaverTails, PKU-SafeRLHF and Aegis loaders no longer return duplicate prompts. Scenario dataset sources and limits must now be set explicitly, and backend scenario reads are async-only.
mpgn/NetExec-mcp
v1.0.6, 6 commits
The nxc_find_tool discovery indexes nxc -M modules, so ldap-only modules like raisechild are now routable when you specify the right protocol. Results carry a structured auth and outcome verdict: a Guest credential is flagged as invalid, a Pwn3d! result is never buried in output, and terminal Kerberos or DCSync errors are flagged rather than scrolled past. Redundant stdout is capped at the model boundary. nxc_call now tolerates flat, zero-arg, or scalar arguments, breaking the repeated-missing-args loop. Offensive-block messages are sharper, and smb_get_file, roasting, and ldap_bloodhound gained saved_to, output_file, and dns_server options. The server runs on FastMCP 4.0.x with MCP SDK v2.
promptfoo/modelaudit
modelaudit-picklescan-v0.1.12 to v0.2.54, 5 commits
modelaudit now preserves raw evidence alongside scan output and diagnostics, so a tester can see the underlying data behind a finding rather than just a verdict. Scanning PyTorch files no longer misses storage prefixes that previously created discovery gaps. Pickle scans refresh importer snapshots between runs instead of carrying state over from a prior scan, and picklescan now bounds repeated scalar probe work so it cannot run unbounded on crafted inputs. Safetensors scanning preserves native FDICT-shaped headers instead of losing them during parsing. GitPython and AnyIO are now held to enforced security floors.
promptfoo/promptfoo
code-scan-action-0.2.1 to 0.124.1, 262 commits
Promptfoo's red team now includes an arabic-presentation-forms static encoding strategy for jailbreak testing. Assertions gain rouge-l and rouge-s scoring types, optional Unicode normalization for equals and contains checks, and the ability to filter trace spans by attribute. Eval runs now report stability across repeated tests, and a safe mode can disable inline JavaScript execution during evaluation. The red team no longer invents an SSRF severity when the grader fails, llm-rubric now fails closed when a grader response omits its verdict, and iterative attacks now preserve grader errors. The --filter-metadata flag accepts comma-separated OR values. Claude Agent and Codex SDKs are now opt-in installs, and the hosted ChatKit provider has been removed.
samugit83/redamon
50 commits
Redamon now detects serialized-object deserialization candidates and can run an agent skill to confirm them, ranking each candidate with a Jev score and surfacing it as a card in AI in Pipeline. The graph map shows an empty-graph card with a Start Recon button when a target has no data yet, and an alert lets you enable the deserialization skill for a full scan cycle. Recon fixes stop false positives from takeover, origin discovery, cache poisoning, vhost/SNI enumeration, JS secrets and source maps, and DOM sinks, while keeping the findings those filters were hiding. Shodan passive CVE grading now survives worse runs. The MCP interface mutes or unmutes up to 5,000 findings per call with no daily cap.
snyk/agent-scan
2 commits
Two dependency bumps. Nothing changed in the tool.
trailofbits/skills
3 commits
The Chrome MCP troubleshooting plugin has been renamed to avoid clashing with a reserved name. If you invoke it by name in scripts or configs, update the reference to match the new plugin name.
usestrix/strix
15 commits
Strix lets callers choose which tool finishes the top-level agent's run. MCP catalogs now load before agents discover connections, so scans no longer race ahead of catalog loading and miss MCP tools. PR review runs no longer report a false "ended without calling finish_scan" error, and a run now stops cleanly once finish_pr_review fires. Strix detects whether a model accepts image input, scrubs images from every request to a text-only model, and only strips images when the error is actually an image rejection. The LLM layer bounds both the first stream event and the whole stream, retries 4xx model errors, and logs the upstream provider behind OpenRouter. The CLI adds -r as shorthand for --resume and shows a title column in the resume picker.
vxcontrol/pentagi
2 commits
Two documentation updates to the README. Nothing changed in the tool.
xalgorix/xalgorix
v4.6.148 to v4.6.153, 18 commits
Xalgorix now accepts plain text scan context, including CR-only line endings, and treats links in that prose as reference material, not as target endpoints. Redaction strips provider-internal control tokens from events and model prose before you see them. The agent preserves scan progress through protocol recovery, restoring the registered tool list so it resumes with valid calls. Skill lookups now share one cached catalog index, preventing unbounded memory growth on long-running scans. A scan-wide outage now requires fresh availability failures against each configured target, so stale failure streaks no longer cancel a scan early. Finding reports must now link to saved reports to count as proven work.
What is a highlight?
Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.
| 1 | The tool can run a test, technique or attack it could not before, or reach a new kind of target. |
| 2 | The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding. |
| 3 | The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong. |
| 4 | The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology. |
| 5 | The tool keeps a test inside its scope or rules of engagement in a way it could not before. |