Week of 12 to 19 October 2026
31 of the 82 tools shipped changes last week, across 1185 commits and 21 releases. None left.
Last Week's Highlights
- Armur-Ai/Pentest-Swarm-AI: Pentest-Swarm-AI now re-proves findings live using a new external verification oracle layer.
- Tencent/AI-Infra-Guard: Agent-Scan now tests targets that speak the AG-UI protocol used by CopilotKit, and adds a memory and RAG poisoning detection skill to its probes.
- h5i-dev/h5i: The browser proxy decodes zstd-compressed response bodies, stores proxy-observed bodies decoded, and replays requests with those decoded bodies, letting it reach sites the engine cannot read directly.
AIPentest/CyberStrikeAI
v1.7.24, 41 commits
CyberStrikeAI now verifies attack-chain nodes against real tool calls, confirming each reported step actually occurred. The FOFA integration fix preserves asset location data by using the supported region return field. Timeout handling now distinguishes task deadlines from child operation timeouts, preventing premature failures. Resuming a task restores existing scripts and test outcomes instead of rerunning them. SQLite asset upserts under concurrent load now wait out lock contention. Token usage tracking now captures cache-write tokens lost in streaming and persistence, and corrects DeepSeek cache-hit reporting.
Armur-Ai/Pentest-Swarm-AI
41 commits
Pentest-Swarm-AI now re-proves findings live using a new external verification oracle layer. The --verify flag turns on OOB callback, differential-response, and statistical timing oracles that confirm hits against the real target. For BOLA findings specifically, the tool recovers the {id} template and victim id from the hit URL and re-proves it through a live oracle. The differential oracle no longer flags echoed-id divergence as a false positive. Verified findings carry a VERIFIED badge and oracle receipt in the report, show as 1.0-weight edges in the Attack Path to Objective, and appear in SARIF output. Bug-bounty submissions now lead with the verification proof.
KeygraphHQ/shannon
1 commit
Shannon's stop command now repairs orphan and empty stop states instead of leaving them broken, and runs faster when clearing them.
Lab700xOrg/aisbom
6 commits
Six dependency bumps last week. Nothing changed in the tool.
Masriyan/Claude-Code-CyberSecurity-Skill
17 commits
The skills and cyberskill directories were removed and replaced with files added directly to the repository, along with their cached bytecode directories. Nothing changed in the tool.
NVIDIA/SkillSpector
v2.13.0, 218 commits
SkillSpector's static analysis now flags shell decode-and-execute chains and warns on multiline scripts that open a remote shell, while keeping the existing single-line detections intact. Findings now survive malformed LLM responses, failed provider batch calls, and malformed or alternative OMS bundles instead of being dropped. Skill-card credential type labels are now reported as disclosures rather than credential access, and checksum context is normalized so decoded findings are no longer wrongly suppressed. Static-only scans no longer require an active LLM provider. The Codex CLI analysis provider is disabled because its read-only sandbox can expose host secrets; use another supported provider. MCP HTTP listeners are now restricted to loopback, so remote deployments need an authenticating proxy.
NVIDIA/garak
v0.17.1, 22 commits
Garak now reports a hit@k attack success rate metric, shown in terminal output and per probe/detector pair in the final digest entry of report.jsonl. The mitigation.Prefixes detector now matches only at the start of the response. FileDetector no longer scores an unexamined file as a pass, and RefusalOnlyAdversarial no longer over-counts skipped multi-turn attempts. Garak now runs on Python 3.14. If you script it, --target_name now sets the WebSocket generator uri.
PurpleAILAB/Decepticon
v1.4.0 to v1.5.2, 134 commits
Creating an engagement now only asks for a name and target URL; Decepticon auto-generates the RoE and approval and opens Red directly, without a prewritten scope file or manual approval step. The launcher can serve native Desktop local engagements. Artifact search now tracks artifacts through a UUID registry with OPPLAN search contracts, and recovery stays pending after a failed publish, preserving receipts for parallel failed search tasks. SARIF import/export now runs through the current run's sandbox and graph partition. CVSS v3 vectors with duplicate metrics or unsupported versions are rejected before scoring. The CLI's decepticon doctor --json gives read-only diagnostics, and /alerts and /status surface Blue monitoring state during a Red conversation. Update with decepticon update --channel latest.
SnailSploit/Claude-Red
1 commit
Only a README update last week. Nothing changed in the tool.
SpecterOps/skills
3 commits
The BloodHound skill now matches the current upstream OpenHound layout, so the skill's structure lines up with what OpenHound actually ships. BloodHound development guidance within the skill has been synced to match upstream as well. The plan-collector skill gained an Existing Research section for tracking prior findings during planning.
Tencent/AI-Infra-Guard
v4.6.6, 20 commits
Agent-Scan now tests targets that speak the AG-UI protocol used by CopilotKit, and adds a memory and RAG poisoning detection skill to its probes. Agent-Scan also adds Atlas Cloud and API Route provider presets for pointing scans at those endpoints. The CLI can now output scan results as JSON. Agent-Scan streams SSE responses and stops at the DONE marker instead of waiting for the connection to close, and surfaces terminal ChatStream errors to the caller and scan status instead of hanging. Skill-Scan recovers tool-call arguments it previously lost during discovery, and the runner now classifies severity using the vocabulary the data validator actually accepts. The model provider no longer panics on unclosed JSON fences or on responses with no choices. The dashboard model dialog lets you edit extra_headers and extra_body, and keeps those stored values when an update sends back a masked version instead of dropping them.
berylliumsec/nebula
nebula-v3.0.22 to nebula-v3.0.30, more than 300 commits
Butler now persists task plans across agent rounds and enforces them in provider chat turns, with plan directives exposed through the chat planning API. A global Butler mandate and scheduler delivers guidance to scheduled harness sessions, with Act recovery scoped to a single project. Headless security tools run independently of the Electron cutover, so you can exercise the security dashboard without the desktop app. Storage integrations ship with a Storage settings page and global dashboard, backed by public storage sender and action contracts and a configurable webhook origin. New project chats default to peer messaging between agents, with harness peer tools gated by capability and cloud settings.
capture0x/AdStrike
2 commits
Two documentation and install script updates. Nothing changed in the tool.
cisco-ai-defense/mcp-scanner
1 commit
The static analyzer's resource allowlist now ignores MIME parameters when matching content types, so resources are no longer missed or flagged incorrectly due to parameters appended to the MIME type.
cisco-ai-defense/skill-scanner
2.3.0, 7 commits
Skill Scanner detects plain-language instructions that send a local credential file to a remote host, flagged as ACTIVE_SENSITIVE_EXFILTRATION. Every finding carries a Cisco AI taxonomy code, an AITech code and where applicable an AISubtech code, with crosswalks to OWASP, MITRE ATLAS and NIST AML, plus taxonomy counts in SARIF and scan metadata. The frontmatter scan now reads every SKILL.md value and comment except allowed-tools as the loader parses it, so escape sequences, YAML aliases and folded values no longer hide text, and scan-all reports symlinks and skills that fail to load as findings instead of skipping them silently. Taxonomy codes follow taxonomy 2.0.0, moving jailbreak and hardcoded-secret findings to new codes, so update any filters built on the 1.x codes.
confident-ai/deepteam
7 commits
Nothing changed in the tool. Last week's commits were documentation and navigation updates, plus a release with no functional commits behind it.
dreadnode/ares
9 commits
Nine dependency bumps. Nothing changed in the tool.
elementalsouls/Claude-BugHunter
7 commits
These commits only refresh the repository's star history chart. Nothing changed in the tool.
google/mantis
15 commits
Mantis now ships a GitHub Action that scans pull requests, with cloud-side setup done through a single command. Scans can leave parts of a target out. Mantis keeps knowledge from different models separate and stores what it learned in the repository. Campaigns now wait for a database lock instead of failing outright. --resume actually resumes a scan. Mantis retries an empty model turn the same way it retries a 429. All command line invocations, including main.py, now go through the launcher's parser.
h5i-dev/h5i
20 commits
The websec skill now matches all occurrences of a check and gives clearer error messages, and its docs cover the blind-oracle workflow for confirming blind vulnerabilities. The browser proxy decodes zstd-compressed response bodies, stores proxy-observed bodies decoded, and replays requests with those decoded bodies, letting it reach sites the engine cannot read directly. The GPU backend generalizes its inputs and validates batch outputs. Read subqueries are optimized for performance across the app.
microsoft/PyRIT
125 commits
PyRIT adds LSBImageStegoConverter and LSBImageStegoDecodeConverter for hiding and recovering payloads in image pixels. The GUI gains a findings dashboard with persistent Operations, a saved attack results analytics view, and a dataset example table with seed detail view. Attack analytics is now exposed over REST. Scenarios can run a single technique against an objective directly with technique.execute, and attack techniques now declare target and dataset requirements. Scorers for SSRF, SQL injection, path traversal, credential leaks, and shell commands fix false positives and missed matches, and CodeChameleonConverter's binary_tree and length mode decryption is fixed. Creating targets that run model repository code now requires administrator access.
mpgn/NetExec-mcp
v1.0.7, 4 commits
NetExec-mcp authenticates to LDAP using Schannel certificates with the new --schannel flag. The mssql_query command now parses result sets into a structured rows list instead of raw output. rdp_exec answers the RDP exec tty prompt automatically, so it runs correctly under the MCP.
msoedov/agentic_security
12 commits
The verify endpoint now returns a 400 error for bad specs and upstream failures instead of failing silently. The refusal classifier now matches judge verdicts on word boundaries, avoiding partial-word mismatches. The dataset registry now checks Hugging Face datasets via their metadata and has deactivated three dead datasets, so scans no longer waste time on them. Agentic_security dropped its Docker image and the CI workflow that built it. The harness now lazy-imports httpx and fire, so startup is faster.
promptfoo/modelaudit
35 commits
ModelAudit now scans models built with CPython 3.14, extending picklescan's opcode support to the new version. The GGUF scanner recognizes the remaining ggml tensor types and validates interleaved row groups per matrix. The ONNX scanner now preserves weight coverage across bounded control-flow branches. Pickle scanning no longer flags license text as a false positive. Metadata extraction errors are now preserved in filtered and directory output. The directory table's row display limit is now configurable. JSON output no longer leaks YAML fallback warnings into stdout. Click 8.5 detection and Windows scanning are restored.
promptfoo/promptfoo
62 commits
Promptfoo now configures Daybreak access program providers. The Gemini provider supports current Gemini media models. Assertions honor the not- prefix on tool-call validity checks, so negated assertions evaluate correctly. XML assertions now match the actual required elements instead of misreporting them. Code scan explains why a scan found no files instead of showing a bare "No files to scan" message. The OpenAI Agents provider rejects invalid retry policies instead of accepting them silently. Eval repeat-stability checks now count cached graders. Google embeddings and catalog data were updated for the Google provider. jks-js is now an optional peer dependency, so installs no longer pull it in by default.
samugit83/redamon
34 commits
Redamon now lets you upload, replace or remove a project's Rules of Engagement document from the form or the RoE page, keeping each superseded version and tying every run to the RoE that produced it. The agent's prompt no longer carries raw RoE text; client text is quoted instead, and RoE downloads are now owner-only with safe headers. Redamon closes an unauthenticated SSRF in /tradecraft/verify (CVE-2026-111323). The report now reads whole-number CVSS scores as numbers. The RoE parse log reports when a model call failed. The plugin platform (1.1.0) stays always on, and Skiller (1.1.0) ships refreshed agent skills.
snyk/agent-scan
4 commits
Agent-scan now discovers Copilot CLI session projects as part of its scan target coverage. The Agent Guard forwarder now bounds its request and fails open on transport errors, so a failing connection no longer blocks the scan. The hooksConfigured test event now requires a success:true payload, which fixes cases where it reported hooks as configured without confirming success.
trailofbits/fickling
2 commits
Fickling no longer throws an AttributeError when checking pickles that use the EXT1, EXT2, or EXT4 opcodes.
trailofbits/skills
14 commits
The entry-point-analyzer skill now supports Codex and corrects how it classifies callers. The yara-rule-authoring skill fixes its examples and adds a one-call review helper. The trailmark-finding-triage skill fixes its broken query recipe and adds a one-call evidence packet. The firebase-apk-scanner skill now reports what the scan actually found. The mermaid-to-proverif skill reads ProVerif results correctly and tests forward secrecy properly, fixing results that were previously wrong. The zeroize-audit skill is now agent-agnostic, so it runs with any coding agent. Resource path fixes correct broken file lookups in the YARA skill and the let-fate-decide skill.
usestrix/strix
18 commits
Strix now lets agent pauses survive more cleanly: a paused agent keeps its pause reason and drains queued messages on resume, and an operator pause holds under every budget policy until resume_budget explicitly lifts it. Dependency findings in reports can now carry code_locations, and the static-analysis disclaimer no longer appears on dependency evidence. The LLM layer accepts extra request-body fields via the LLM_EXTRA_BODY setting, and malformed tool-call arguments are replayed as valid JSON instead of failing. Sandbox creation can defer its bring-up behind a DeferredSandboxSession when called with defer=True, and extra_files can now be passed as an awaitable so sandbox create does not block on it. The TUI sidebar now lists a run's targets with accurate hidden-target counts.
xalgorix/xalgorix
3 commits
Settings no longer clobbers the local runtime endpoint when you save changes, so a configured endpoint stays set. The local runtime endpoint is now exposed directly in settings rather than hidden.
What is a highlight?
Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.
| 1 | The tool can run a test, technique or attack it could not before, or reach a new kind of target. |
| 2 | The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding. |
| 3 | The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong. |
| 4 | The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology. |
| 5 | The tool keeps a test inside its scope or rules of engagement in a way it could not before. |