GitGuardian’s research team published a catalog of roughly 45 open-source agentic pentest frameworks on November 9, 2026, each one wiring a language model into a loop that runs offensive tools.
Quick Take
- What: GitGuardian cataloged 45 open-source agentic pentest frameworks that connect language models to offensive security tools
- Exposure: 11 of 41 fingerprinted frameworks serve operator consoles on network ports by default; Shodan found 1,428 ARTEX family services, 419 PentAGI, and 173 Agent Zero instances on November 7, 2026
- Risk: Lab test showed a build with no scanner used git and grep to recover 8 of 9 planted credentials, including one deleted a commit after it was added, starting the hunt 6 to 13 seconds in
- What to do: Hunt for exposed consoles using GitGuardian’s fingerprints, revoke all credentials reachable from repositories these agents could read, scan entire repository history
In plain English
Researchers found dozens of open-source tools that let attackers connect AI language models to hacking software. These tools can automatically run security tests and search for passwords. Eleven of these tools open a web control panel on the internet by default, and researchers found over 1,400 of them running in the wild. In a test, one tool found 8 out of 9 hidden passwords in under 15 seconds, even recovering a password that had been deleted from the code history.
What you should do: If you run any of these tools, check that your control panel is not exposed to the internet. If you store code or credentials anywhere these tools might reach, treat those credentials as compromised and replace them immediately.
What happened
GitGuardian’s research team published a catalog of roughly 45 open-source agentic pentest frameworks on November 9, 2026. Each framework wires a language model into a loop that runs offensive tools. The team sorted 32 of them into five families and treated the rest as forks or variants.
ARTEX’s author took that project down on October 8, 2026, 74 days after its first commit. In the takedown week alone, 102 ARTEX-named repositories and forks appeared.
How the frameworks work
GitGuardian sorted the frameworks into five families based on what the loop does:
- Network kill chain tools such as PentAGI run reconnaissance through post-exploitation from a Kali container
- Web-app and API tools such as Strix test applications
- C2-integrated builds run inside frameworks like Mythic
- Harnesses wrap a general coding agent with offensive skills
- Research prototypes come out of academic work
Only four builds ship a secret scanner wired to the agent: Pojun, Cybermes, Xalgorix, and AIRecon. GitGuardian notes that the shell and web access these tools hand the model puts a scanner download or a GitHub search one improvised tool call away.
Lab test results
A lab run published the next day demonstrated the credential-hunting capability. An ARTEX build with no scanner used git and grep to recover 8 of 9 planted credentials, including one deleted a commit after it was added. The tool started hunting 6 to 13 seconds in, even under a prompt that never mentioned secrets.
Exposure findings
GitGuardian assessed 41 frameworks for network exposure:
- 11 frameworks serve a web UI on a network port by default
- 18 frameworks do so only in some setups
- 12 frameworks have no listener at all
On November 7, 2026, Shodan matched:
- 1,428 services in the ARTEX family
- 419 PentAGI instances
- 173 Agent Zero instances, of which 134 sat behind a login and 39 were open
Risk clusters in a few heavily forked bases rather than the most-starred projects. The most-starred tool in the catalog, Strix, ships no secret-hunting code, while Pojun, with fewer than a hundred stars, wires gitleaks into its worker prompt.
What you should do
GitGuardian recommends:
1. Hunt for exposed consoles using the fingerprint descriptions GitGuardian published, not a target list
2. Revoke credentials rather than deleting them, because the lab run recovered a key from git history one commit after deletion
3. Scan whole repositories and their history, not only the files at the current commit
4. Treat every credential reachable from a repository these agents could read as exposed
