KeygraphHQ / shannon

2025-09-27 · Source: Github Trending: All languages · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, extended

Summary

Shannon, an autonomous, "white-box" AI pentester by Keygraph, analyzes web application source code to identify attack vectors and executes real exploits, providing reproducible Proof-of-Concepts for vulnerabilities like injection and XSS. Leveraging a multi-agent architecture with Anthropic's Claude Agent SDK, it performs parallel vulnerability analysis and exploitation, adhering to a "No Exploit, No Report" policy to minimize false positives. Available as Shannon Lite (AGPL-3.0) and Shannon Pro (commercial), the latter offers an integrated AppSec platform with static-dynamic correlation, validating static analysis findings with live exploits and tracing them to source code. Shannon has demonstrated strong performance, scoring 96.15% on the XBOW security benchmark and identifying over 20 vulnerabilities in OWASP Juice Shop, though it is intended for non-production environments due to its mutative effects and requires human oversight for LLM-generated content. It supports AI providers like Anthropic, AWS Bedrock, and Google Vertex AI, with a typical test run taking 1-1.5 hours at an approximate cost of \$50 USD.

Key takeaway

Shannon is an autonomous, white-box AI pentester that combines source code analysis with live exploitation to find and prove web application and API vulnerabilities. It scored 96.15% on the XBOW benchmark, identifying critical OWASP issues like Injection and XSS with reproducible proof-of-concepts. This tool enables DevSecOps teams to automate continuous penetration testing, closing the security gap between code releases, but requires human validation and is not for production use.

Topics

• AI Pentesting
• Web Security
• API Security
• Static-Dynamic Analysis
• LLM Agents

Code references

• KeygraphHQ/shannon
• KeygraphHQ/shannon
• your-org/your-repo
• your-org/your-monorepo
• your-org/frontend

Best for: CTO, VP of Engineering/Data, AI Security Engineer, Software Engineer, MLOps Engineer

Related on AIssential

• Formally verified AES-XTS: The first AES algorithm to join s2n-bignum — Amazon Web Services (AWS) has formally verified an optimized Arm64 assembly implementation of AES-XTS decryption, making it the first AES algorithm to join the s2n-bignum library and ensuring mathemat…
• Autoresearch Claude Code Hacker - Can It Breach My Vibecoded Site? — An AI-driven red teaming framework can autonomously test web application security and iteratively refine attack strategies.
• A new native IDE approach to prevent code leakage to LLMs: Obfuscating ASTs before the API call (Verantyx) — Obfuscating code with Kanji-infused structural semantics allows LLMs to reason without exposing proprietary data.
• Continuous Offensive Security: The Line We've Been Walking — AI-driven offensive security is crucial for continuous defense against autonomous attackers and new AI-specific attack surfaces.
• Explainable AI-Driven Cyber Risk Analytics and Model Reliability Assessment for Intelligent Governance of U.S. Critical Infrastructure: An XGBoost and SHAP-Based Intrusion Detection Framework — Integrating XAI with ML-based intrusion detection enhances transparency and trust for critical infrastructure cyber governance.
• Verifying and optimizing post-quantum cryptography at Amazon — Automated reasoning reconciles cryptographic security, performance, and maintainability through formal verification and optimization.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Github Trending: All languages.