Week of 19 to 26 October 2026
32 of the 82 tools shipped changes last week, across 1105 commits and 43 releases. None left.
Last Week's Highlights
- Armur-Ai/Pentest-Swarm-AI: Pentest Swarm AI now ships 13 deterministic verify classes, adding path-traversal/LFI, open-redirect, LDAP-injection, NoSQL auth-bypass, and XXE out-of-band producers alongside the existing SSRF, SSTI, command-injection, mass-assignment, blind-SQLi, and 403-bypass oracles, each wired into the --verify sweep with adaptive re-proofing.
- MythicAgents/Sage: Sage's supervised mode can now pursue a stated objective across turns, proposing one guarded action at a time and querying BloodHound for an attack path to the objective when data is available.
- Tencent/AI-Infra-Guard: Agent-Scan now forwards the prompt and selected skills to the scanner, and reads AG-UI (CopilotKit) protocol streams as a target.
AIPentest/CyberStrikeAI
2 commits
CyberStrikeAI now runs conversations as durable asynchronous jobs, so a long-running test session can continue independently of the client connection. The OpenAI provider now preserves an explicit request to disable reasoning instead of overriding it, so runs against OpenAI models respect the reasoning setting you configured.
Armur-Ai/Pentest-Swarm-AI
v0.3.0 to v0.3.2, 88 commits
Pentest Swarm AI now ships 13 deterministic verify classes, adding path-traversal/LFI, open-redirect, LDAP-injection, NoSQL auth-bypass, and XXE out-of-band producers alongside the existing SSRF, SSTI, command-injection, mass-assignment, blind-SQLi, and 403-bypass oracles, each wired into the --verify sweep with adaptive re-proofing. Recon now runs deterministic, model-independent playbooks against NodeGoat, DVGA, and VAmPI with live-verified findings including cross-user IDOR and RCE. Reports lead with VERIFIED findings first, most severe first, and the dashboard renders the attack path to objective with kill-chains and live exploit-step proof under each chain step. Recon degrades to tool-only surface on LLM outage instead of aborting. OpenAPI/Swagger auto-discovery now checks more locations, and dalfox, Gxss, crlfuzz, and nikto are first-class in install-tools and doctor. The Together provider now defaults to serverless GLM-5.3-Flash since Llama-3.3-70B-Turbo was off serverless and returning 400s.
GH05TCREW/pentestagent
4 commits
Two dependency bumps. Nothing changed in the tool.
Lab700xOrg/aisbom
v1.7.0, 3 commits
Unreadable model weight files that are not pickle-format no longer get rated Risk LOW with a confident framework label. A scan on hf:// model files now checks subfolders and every listing page, instead of only the top-level listing.
Masriyan/Claude-Code-CyberSecurity-Skill
3 commits
Three file uploads and a marketplace.json update, with no detail on what the files contain or what changed in the skill itself. Nothing in the commits says what a tester can now do differently with this tool.
MythicAgents/Sage
v0.2.0, 22 commits
Sage's supervised mode can now pursue a stated objective across turns, proposing one guarded action at a time and querying BloodHound for an attack path to the objective when data is available. The /tools command lists Sage's tools and access requirements without a model call, and /report produces an operation-wide identity report. A request that Sage halts on its own, such as a routing loop or blocker, no longer reports "Completed"; every turn now ends as completed, blocked, or checkpoint. When a request ends inside a specialist agent, the final message and reason now reach the main Sage window. The startup log reports Sage's version, build commit, and source fingerprint, so you can confirm which code a deployment runs.
NVIDIA/SkillSpector
v2.13.1, 22 commits
SkillSpector gives Office worksheets identified by content type and workbook relationships the same 16 MiB analysis allowance as other files, letting a 1.97 MB worksheet receive complete static inspection. Validated Office printer settings no longer trigger executable-content findings just because their filename ends in .bin, unless the printer record and content type disagree. SkillSpector no longer reports false incomplete-analysis findings for ordinary Python report strings, quoted script text, regular expressions, or possessive Markdown prose, and no longer raises false P2 hidden-instruction findings for visible text spanning HTML comments. Shell heredoc parsing retains quote ownership for Python formatted strings, avoiding false unfinished-shell reports. Quoted version numbers in YAML fields are now treated as metadata rather than file references. Security text normalization reuses bounded character caches and processes unchanged text in bounded chunks, cutting PDF and GIF scan overhead while keeping findings and offsets intact.
NVIDIA/garak
11 commits
Garak's summary report now describes targets as LLM-backed applications. The IntentProbe harness now flags when a probe run skips an intent because it was inactive, surfacing the skip in its output. The BEAST probe now runs correctly against Hugging Face Pipeline generators, with its scoring bugs fixed. Garak's harness now materializes results from generator-returning probes, keeping all attempt results. The snowball detector's descriptions now match the scores it reports.
PurpleAILAB/Decepticon
v1.5.4 to v2.1.1, more than 300 commits
AutoBot, the blue mode assistant, is now discovered through entry-points instead of the in-tree Blue Cell, and probes the sandbox to auto-install missing capabilities. Blue gains detection adapters for rules and decisions plus incident batching, and an engagement can declare a blue.json target scope that /blue up reads. Raw Blue detections stay out of the Red feed and surface only through the badge and /alerts, with an inline Blue agent assessment added to that feed. The RoE gate is now enforced on every engagement-creation surface and fails closed, replacing the old audit/warn/enforce modes. The standalone SAST / CI code-scan entry has been removed. Doctor's --deep flag reports the slot matrix, knowledge graph, Skillogy and MCP auth health.
Tencent/AI-Infra-Guard
v4.6.7, 12 commits
Agent-Scan now forwards the prompt and selected skills to the scanner, and reads AG-UI (CopilotKit) protocol streams as a target. Agent-Scan adds Cheaper Inference and Runcrate provider presets. Fingerprint matching now catches AutoGen Studio regardless of a [Beta] suffix in its title, and generic matchers were tightened to drop non-identifying rules that caused false positives. CVE rule ranges and severity vocabulary were corrected, and malformed git-hash version rules were replaced with real version numbers. The scanner no longer panics on unclosed JSON fences with leading text. Each scanner now installs independently via pip.
berylliumsec/nebula
nebula-v3.0.31 to nebula-v3.0.35, 63 commits
Nebula gives providers a goal completion action and classifies rejected historical completion claims before accepting a new one. The MCP catalog now scopes to the selected project. Core enforces formal task plans for Grok and Codex providers, and Butler can hand off a goal to a different provider within the same chat. Gateway failures return an actionable receipt with usage and guidance context for Core tools and built-in MCPs. Workspace uploads are verified against an expected content hash. OpenRouter DeepSeek's xhigh effort now maps to its supported max effort level. Saved harness chats can switch to a different provider in place.
blacklanternsecurity/red-run
2 commits
Two license commits. Nothing changed in the tool.
cisco-ai-defense/mcp-scanner
4.8.7, 8 commits
mcp-scanner negotiates MCP 2.0 and runs against the MCP SDK 2.0, extending its scans to targets speaking the newer protocol. The scanner now extracts dynamically registered tools from TypeScript wrappers instead of missing them. Its yara rules for coercive_injection and credential_harvesting bind wildcard gaps to clause boundaries, and the execution_overrides rule no longer has binding gaps at clause edges, cutting false matches from loose wildcards. The static resource allowlist now ignores MIME parameters when matching. CLI output renders through the Rich library. A stray local import that shadowed the os module in main() is fixed, and the --stderr-file flag now works for config and known-configs scans.
cisco-ai-defense/skill-scanner
2.3.1, 7 commits
Skill Scanner now ships the taxonomy's definitions for every objective, technique and sub-technique, readable through get_aitech_definition() and get_aisubtech_definition(), alongside a generated taxonomy reference covering all 19 objectives, 44 techniques and 130 sub-techniques. The bundled taxonomy snapshot hash changes to reflect this, so update anything that pins scan_metadata.taxonomy.snapshot_sha256. The dependency range now excludes litellm 1.107.0, a hijacked release that drops credential-stealing files into site-packages on every Python start. If pip show litellm reports 1.107.0 on a host where skill-scanner was installed, treat that host as compromised and rotate its credentials. The default models for --llm-provider openrouter and gcp-vertex have changed since the old defaults were retired by their providers. Set SKILL_SCANNER_LLM_MODEL if you relied on the previous default.
confident-ai/deepteam
7 commits
These commits are documentation and blog post edits. Nothing changed in the tool.
dreadnode/ares
4 commits
Four dependency bumps. Nothing changed in the tool.
elementalsouls/Claude-BugHunter
7 commits
All seven commits last week refreshed the star history chart asset. Nothing changed in the tool.
google/mantis
68 commits
Mantis scans in changed mode per directory now, creating one campaign per directory instead of a single campaign for the whole run. The --scan-mode changed flag tracks what content each campaign covered. A verified re-report settles an earlier undecided finding as present, and changed-run campaign scopes no longer nest. A campaign owns the findings it reports wherever they sit in the codebase. The reproduction harness observes the sink without altering it, and re-running a PoC restores its companion files. Models without native context binding, including Claude, get client-side context editing to manage context size.
h5i-dev/h5i
v0.5.1, 17 commits
h5i now runs browser sessions through proxy-mode, replacing its own browser with agent-browser-driven Chromium captured at a proxy the binary runs itself; every request and redirect hop is policy-checked and logged before it moves. When a replay in h5i-websec would otherwise go out unauthenticated, h5i nudges the tester toward the --as flag.
hypnguyen1209/offensive-claude
3 commits
The web pentest module adds WAF bypass techniques and XXE reference payloads. Testing depth increases for request smuggling, XSS, SQLi, and authentication checks, drawing on Claude Red's advanced technique set.
ipa-lab/hackingBuddyGPT
2 commits
Two dependency bumps. Nothing changed in the tool.
microsoft/PyRIT
150 commits
PyRIT adds a char_split attack technique for prompt sensitivity testing. CredentialLeakScorer now flags Azure SAS tokens, SharedAccessKey, and Databricks tokens, plus OpenAI, Anthropic, and Hugging Face API keys. ShellCommandOutputScorer covers modern shells and Azure exfiltration patterns. LDAPInjectionOutputScorer catches Boolean NOT and null byte truncation, SSTIOutputScorer catches Jinja2 statement blocks and ERB/EJS eval probes, and PathTraversalOutputScorer recognizes win.ini and web.config as Windows targets. PackageHallucinationScorer stops flagging Rust std paths, Perl version declarations, and Raku core modules as hallucinated packages. GCG attacks now run a capability preflight before workers start. The Gandalf target and scorer have been removed, and the custom targets notebook is self-contained instead. Creating targets that use the server's stored credentials now requires administrator access.
msoedov/agentic_security
2 commits
Two commits last week, a merge and a documentation update. Nothing changed in the tool.
promptfoo/modelaudit
1 commit
A dependency bump. Nothing changed in the tool.
promptfoo/promptfoo
0.125.0 to 0.125.1, 40 commits
Provider-only environment overrides let you scope environment variables to a specific provider instead of applying them globally across a config. OpenAI provider configs now validate against portable schemas, catching config errors before a run. The eval summary discloses cache-hit rows, so you can see which results came from cache rather than a live call. A fix preserves the original error from remote providers instead of masking it. Eval runs can now report stability across repeated tests, and a safe mode can disable inline JavaScript execution. Trace span assertions can filter by attributes. The jks-js dependency and the Claude Agent and Codex SDKs are now optional peer dependencies rather than required ones.
samugit83/redamon
161 commits
Recon now scans one host set per scope group, grouped by registrable domain through the Public Suffix List, treating a wildcard below that domain as its own scan root. The org is scanned once per run instead of once per scan root. OpenAPI import works as a resource-enumeration tool: declared-only endpoints are labeled and counted apart in Insights, the report, and MCP, and no longer turn a host into an AI Surface target on their own. Agent skills can now be uploaded in batches from project settings or the chat drawer, with a review dialog and Generate with AI that reads names and descriptions from frontmatter. The agent hard-guardrails every listed batch host at session start.
snyk/agent-scan
v0.6.9, 17 commits
Hooks installation in managed mode now skips agents that are not installed instead of attempting to install hooks for them. The PowerShell hook command now carries the tenant id, so uninstalling an agent correctly revokes its push key. When a scan is sent, the CLI now prints a confirmation that the scan was pushed successfully.
trailofbits/fickling
3 commits
Fickling now runs on Python 3.11 through 3.15.
trailofbits/skills
6 commits
The skills set adds warnings when CodeQL or Semgrep exclusions are applied, so you can see when a rule is suppressing results rather than silently dropping them. Two new Calcifier recipes bring github-triage and dimensional-analysis workflows into the skill set. Two new plugins, regression-hunt and patching-bugs, add targets for hunting regressions and working through bug patches.
usestrix/strix
20 commits
Strix expands XSS coverage to catch HTML injection and normalization issues. The root agent now follows up on open coverage rows before finishing a scan, and sub-agents get soft per-skill turn limits so no single skill exhausts the agent's turns. Callers can turn on parallel tool calls with STRIX_PARALLEL_TOOL_CALLS and pick which report tool runs. Reporting keeps HTTP exchange evidence instead of dropping it when the proxy is slow to verify request ids. Coverage ledger instructions and reconciliation steps no longer vanish from skills and finish_scan when coverage tools are off. The sandbox container now receives host devices through STRIX_DOCKER_SANDBOX_DEVICES. Setting STRIX_RUN_RECORD_TIMINGS records each provider request's timing, provider and token counts in run.json's llm_requests.
vxcontrol/pentagi
1 commit
One dependency reference update. The README now links Graphiti to its public repository and names the image PentAGI runs. Nothing changed in the tool.
xalgorix/xalgorix
v4.6.154 to v4.6.172, 49 commits
Scans now finish cleanly under principled finish (XALGORIX_CONVERGE_FINISH), closing untested endpoint hypotheses so the terminal status reads completed instead of incomplete, with untested endpoint and class pairs recorded in the report. Epoch-based coverage convergence (XALGORIX_EPOCH_COVERAGE) lets scans on growing attack surfaces reach a terminal state by testing fixed snapshots in bounded epochs instead of running until a watchdog cuts them off. Endpoint hygiene (XALGORIX_ENDPOINT_HYGIENE) strips non-route noise, such as tool-config paths and template variables, from the coverage baseline so scans converge instead of stalling at a false completed coverage. Native tool calling (XALGORIX_NATIVE_TOOL_CALLS) sends tool definitions as structured data on backends such as llama.cpp, Ollama, and vLLM, so a malformed XML tool call no longer discards an iteration. A structured provider error code now distinguishes a transient rate limit from genuine quota exhaustion, and a quota-exhausted key in the pool is skipped for fifteen minutes instead of being retried every ninety seconds.
What is a highlight?
Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.
| 1 | The tool can run a test, technique or attack it could not before, or reach a new kind of target. |
| 2 | The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding. |
| 3 | The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong. |
| 4 | The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology. |
| 5 | The tool keeps a test inside its scope or rules of engagement in a way it could not before. |