Week of 2 to 9 November 2026
30 of the 83 tools shipped changes last week, across 1230 commits and 30 releases. None left.
Last Week's Highlights
- microsoft/PyRIT: PyRIT's Jailbreak scenario now delivers jailbreak_multi_turn attacks across multiple turns.
- xalgorix/xalgorix: A new probe_body_contract tool discovers which JSON body fields a POST, PUT or PATCH endpoint expects by reading its own validation errors.
- usestrix/strix: Strix integrates opengrep, giving it an added static analysis engine to run against target code.
0xSteph/pentest-ai
v1.6.0 to v1.6.1, 6 commits
Pentest-ai halts only a paced scan when the target stays degraded, and ends that halt together with its engagement. MCP clients now see each tool's whole docstring as its description, including on fastmcp 4. Program profiles now load correctly on Python 3.10. The default Claude model is claude-sonnet-5-5, up from claude-sonnet-4-6, but only when ptai calls Anthropic directly through ptai start with ANTHROPIC_API_KEY set and PENTEST_AI_MODEL unset. Over MCP, the host client's model drives the scan instead.
AIPentest/CyberStrikeAI
4 commits
Multiagent streaming now keeps tool call indices in order when multiple agents interleave their output, so agentic stream results no longer get scrambled across tool calls. Plugin authentication supports username-based RBAC login, letting plugins authenticate against role-based access control using a username instead of whatever credential they required before.
Armur-Ai/Pentest-Swarm-AI
10 commits
The scan command now accepts a --discovery flag that consumes a Hayagriva DiscoveryBundle as input. The suite emits an AssessmentSnapshot built from the attack graph. A new adapter converts a DiscoveryBundle into a ctxpack.Pack, letting discovery output feed into context packing. The --context flag no longer reports ingestion as "coming soon"; context ingestion now runs.
GH05TCREW/pentestagent
2 commits
Two dependency bumps. Nothing changed in the tool.
KeygraphHQ/shannon
6 commits
Shannon now validates workspace names and restricts target URLs to HTTP and HTTPS schemes, rejecting other protocols before a run starts. The worker links the OpenAI cyber-access error message directly to chatgpt.com/cyber so testers can resolve login failures from the error itself. Subscription logins now require Node.js 22.19 or newer.
Lab700xOrg/aisbom
1 commit
The aisbom comply command now ships documentation packs, giving testers compliance documentation output alongside the existing SBOM data.
NVIDIA/SkillSpector
v2.13.4, 289 commits
SkillSpector now inspects TAR and GZIP archives within shared bounded limits, accounting explicitly for any members it omits. Markdown rule files with the .mdc extension are now classified and parsed as Markdown, so their contents get the same coverage as other Markdown targets. Malformed AI assessments, including plain-text and single-field responses, are now recovered into visible findings, and unverifiable formatting-only responses carry an explicit warning. Provider outages no longer produce synthetic security findings, and refusals are now distinguished from missing telemetry. Each finding report now exposes the file surface it landed on. Archive member byte capacity is configurable for large skill bundles.
NVIDIA/garak
34 commits
Garak adds an intent typology listing to the CLI, letting you list probes by the intent they test. The technique_intent_matrix now shows which probes contribute to each cell, and carries probe_detector_pairs for analysis. New IntentProbe siblings cover goodside.ThreatenIntent and encoding decode-and-act prompts, GrandmaIntent coverage is complete, and per-payload-group and per-product intent associations split product-key intents more finely. IntentProbe runs keep their original detectors intact across runs, and duplicate prompts generated within IntentProbe, promptinject, and conversation runs are removed. StringDetector now treats empty string outputs as inconclusive. LDNOOBW and SlursReclaimedSlurs honor a matchtype config override.
PortSwigger/mcp-server
10 commits
The Burp MCP connection now ships as a Codex plugin, bundled with a skill, so Codex users can install it directly. The server now serves the MCP transport over Streamable HTTP at the /mcp endpoint. The bundled Kotlin MCP SDK and proxy are upgraded to 0.16.0.
PurpleAILAB/Decepticon
110 commits
Decepticon's sandbox backend now defaults to OpenShell for running agent sessions. The RoE (rules of engagement) compiler can now combine mixed host and CIDR scopes into a single policy, and OpenShell is the only network boundary enforced, since the nftables path has been retired. Agent step budgets have been raised to 2000 and are now operator-tunable, with the budget wrap-up enforced before the hard cap. Scope copies into a sandbox are now restricted to the admitted workload owner, and the RoE layer rejects denied scope intersections and refuses sandboxes that fail OpenShell admission. Browser sessions now reuse the persistent context's blank startup page instead of opening a new one.
SpecterOps/skills
3 commits
The skills library adds a skill for Outflank C2 operations, giving the agent commands for running that C2 framework. The library also adds a set of macOS commands, extending the skills to cover macOS targets.
Tencent/AI-Infra-Guard
v4.6.9, 3 commits
MCP-Scan now parses XML-attribute parameter tags returned by OpenAI-compatible models instead of failing on them, and normalizes mixed-case MCP SARIF rule IDs so findings merge correctly. Agent-Scan accepts null content deltas and usage-only chunks in SSE replies without erroring. Agent-Scan adds a CloudGPU provider preset, while third-party provider presets have been removed. Task-server HTTP clients now time out instead of hanging.
berylliumsec/nebula
nebula-v3.0.40 to nebula-v3.0.45, 57 commits
Nebula's paired terminal Assistant now runs as a full-screen TUI with live feedback, and you can also launch a lightweight paired terminal Assistant or a paired Butler chat with headless Core launch. Project Notes and an on-demand Project Snapshot are now available directly in the paired terminal client. Nebula now supports verified PostgreSQL migration and production database recovery, and no longer repeats recovery when the archive lists public. Provider capacity for simulation can now go above 32, with defaults raised to 60 and 58. Terminal chat sessions show running conversations first, recall sent messages in the composer, surface contextual slash commands, and support native text selection. The terminal no longer crashes after an empty Core timeout error.
cisco-ai-defense/mcp-scanner
3 commits
The scanner's prompt injection override rules now match "previous" and "prior" qualifiers in YARA matching, catching overrides that use those wordings. Nothing else changed in what the scanner tests or reports last week.
cisco-ai-defense/skill-scanner
4 commits
The alignment analyzer's behavioral checks now default to a current Gemini model after the previous default, gemini-2.0-flash, was retired. SARIF output now reports the actual installed package version in tool.driver.version instead of an incorrect one.
elementalsouls/Claude-BugHunter
7 commits
Seven dependency bumps and asset refreshes. Nothing changed in the tool.
google/mantis
9 commits
Pull request scans can now write their findings as SARIF. Mantis enforces deterministic filepath validation and canonicalization for findings, closing a source of inconsistent results. Scan mode changed revert detection, lineage closure, and resume validation are hardened to catch more cases correctly. A single file refusal now names only the tools that can actually answer, rather than all tools.
h5i-dev/h5i
v0.5.3 to v0.5.4, 25 commits
h5i-app now supports an embedded webserver, letting you host test targets directly from the framework. h5i-app reads support range comparisons, >= and <, on integer columns. h5i-app-pg retries automatically when a SERIALIZABLE transaction runs out of its conflict pool. Pipelined statements in h5i-app-pg now report the error that failed the transaction.
microsoft/PyRIT
149 commits
PyRIT's Jailbreak scenario now delivers jailbreak_multi_turn attacks across multiple turns. ASSERT conversation scoring runs as a standalone scorer, grading a full conversation without launching an attack. GCG attacks validate control round trips and cache vocabulary fingerprints. SSTIOutputScorer detects multi-engine RCE gadgets, ShellCommandOutputScorer detects command substitution, and output scorers now flag obfuscated SQL injection and javascript: payloads. CredentialLeakScorer catches connection strings with an empty username. OpenAI-compatible targets support a "no key" auth mode for endpoints that don't require credentials. CLI scenario polling now handles Ctrl+C cleanly instead of hanging. If you script it, the pyrit CLI command is now pyrit_scan with its subcommands, and the deprecated --list-* flags are gone.
mpgn/NetExec-mcp
v1.0.8, 21 commits
NetExec-mcp adds smb_reauth_swap, a tool that promotes nxc's reauth_swap module. Dynamic mode now ships a static -M module catalog and anchors relative output paths. The agent no longer mistakes T-SQL errors or exec-method failures for auth failures. Admin-only actions that nxc skips are now reported, and the agent refuses them without a credential. Command-execution queries now rank exec tools first, and curated tools now rank above the -M modules they wrap. workspace_creds can be filtered by username and credtype. Each nxc_call writes a per-call log file to NXC_LOG_DIR. Mode-gate refusals are now terminal.
msoedov/agentic_security
2 commits
A new cheapaimodel preset is now available in the LLM specs, letting you point scans at a lower cost model option when configuring targets.
promptfoo/modelaudit
modelaudit-picklescan-v0.1.13 to v0.2.56, 89 commits
When OPENAI_API_KEY is set, modelaudit scan can send selected warning or critical README and model-card findings to OpenAI for triage advice, printed to stderr without changing verdicts or exit codes; run with --no-triage to keep the scan local. Consolidated checks now keep the highest failed severity and its explanation for each asset, and summaries label informational findings as such. Scans no longer report GGUF, GGML, and sharded models as incomplete on Windows when a file's creation time differs between its path and its open handle. The scanner cuts false positives on model-card links, README examples, pinned package versions, CSS dimensions, and Bitcoin-like identifiers. Upgrade modelaudit-picklescan to at least 0.1.14 for updated source-snapshot checks and clearer pickle invocation warnings.
promptfoo/promptfoo
183 commits
Promptfoo now evaluates Gemini Live and Vertex file transcription, GPT Image 2.6 generation and edits, GPT-5.6 Cyber on Bedrock, Sol Ultrafast, and Nova and Marengo text embeddings. Azure and Anthropic providers validate their config schemas before a run. AI21, Hugging Face, and Azure completions now keep their empty-output semantics, Vertex Llama model IDs and multi-region Vertex Flash Image pricing resolve correctly, and a Bedrock Nova message with no content returns no output instead of throwing. Azure Storage connection strings are redacted from logs and exports, and saved cloud credentials are protected in config. The CLI now prints the full evaluation summary when sharing is unavailable.
samugit83/redamon
v7.5.1, 149 commits
Agent in the Loop runs as a step loop over MCP, pausing for confirmation before dangerous tools run via job_spawn and flagging unattended runs. Agent in the Loop and its MCP server are on by default. Redamon imports GitHub, GitLab, Bitbucket and Codeberg repos, archives, folders and files into a workspace, and mirrors websites honoring RoE exclusions and robots.txt. urlscan feeds Origin Discovery and flags leaked one-time links, secrets in URLs, sensitive files, problem pages and outbound redirects, with backfill limited to one project. Katana, tlsx, naabu and httpx resolve through the scan's resolver, and the ZAP Ajax Spider no longer leaks containers or OOM-kills its JVM. If you script it, recon tool images are fixed, not a per-project setting.
snyk/agent-scan
v0.6.11, 7 commits
Guard now supports install for the copilot client, and uninstall has been tested across all supported clients. Antigravity skill discovery now finds current skill paths, so skills in that location are no longer missed. The hook script version is now stamped at release time instead of install time, so the version reported by an installed hook matches the release that shipped it.
trailofbits/fickling
v0.1.13, 5 commits
Fickling blocks aifc and sunau in its unsafe imports list, adding to an expanded blocklist of code execution, file access, and networking gadgets. The scanner now detects private stdlib imports, including subinterpreter modules that can execute arbitrary code, and extends that detection to underscore attributes and qualified names. Fickling hooks pickle._load, pickle._loads, and pickle._Unpickler so those Python entrypoints get scanned too. PyTorch checkpoints are now analyzed with PyTorch's own ZIP reader. Fickling rejects inconsistent FRAME boundaries that could hide executable opcodes and recomputes frame lengths when serializing edited pickles. False positives are reduced for returned values, object state, dictionary keys, and standard library modules. A fix addresses an AttributeError that occurred when encoding an INST opcode. Python 3.10 support is dropped, with 3.11 as the new minimum and 3.15 now supported, and the ineffective max_acceptable_severity parameter is removed from FicklingContextManager.
trailofbits/skills
4 commits
The skills library adds a CVSS v4.0 scoring plugin, letting you score findings using the current standard instead of leaving that step to another tool. PoC generation now skips absent or unreadable PoC sources rather than including broken references in the output. Generated PoCs also preserve uppercase .C file extensions as C++ instead of misclassifying them.
usestrix/strix
5 commits
Strix now has a skill that covers email identity canonicalization drift, testing for cases where differences in how systems normalize email addresses, such as Gmail dots or plus addressing, let an attacker register or match an identity that should be distinct. The report pipeline now validates its deduplication decisions, so findings are no longer merged or dropped on bad dedup logic. Strix integrates opengrep, giving it an added static analysis engine to run against target code.
vestjoe/trove-skill
12 commits
Documentation only last week. Nothing changed in the tool.
xalgorix/xalgorix
v4.6.175 to v4.6.184, 21 commits
Xalgorix confirms authentication-bypass findings with a new verify_authbypass check, retrying a denied route under equivalent spellings and reporting it under a dedicated auth-bypass class. A new probe_body_contract tool discovers which JSON body fields a POST, PUT or PATCH endpoint expects by reading its own validation errors. verify_sqli and verify_ssti now inject into JSON and form request bodies as well as the query string, and detect more PostgreSQL and SQL Server error signatures. A port in the target URL now pins the scan to that port, and a single-target scan no longer enumerates subdomains. Confirmed SQL injection, template injection and XXE findings now survive to the report, and only engine-verifier evidence counts as proof, not text the model writes itself.
What is a highlight?
Each week an AI model reads every entry and picks up to three changes that matter most to the people running these tools. It looks for these, most important first. Each highlight quotes the sentence from the tool's entry that shows the change, with the sentence before it when it needs one.
| 1 | The tool can run a test, technique or attack it could not before, or reach a new kind of target. |
| 2 | The tool produces a new kind of output a tester can hand on, such as an attack map, a report or verified proof of a finding. |
| 3 | The tool's results can be trusted where they could not before: findings are now verified, or a fix corrected results that were wrong. |
| 4 | The tool tests more of a target than before: more vulnerability classes, more hosts or roots, more of a methodology. |
| 5 | The tool keeps a test inside its scope or rules of engagement in a way it could not before. |