SwarmAutonomous penetration testing agent

SwarmAttacker is an open-source autonomous penetration testing agent that tests a web application from nothing but its URL. A swarm of language-model agents maps the target, finds vulnerabilities, and writes up what it found. It is MIT licensed, the code is on GitHub, and it runs on the ChatGPT subscription you already pay for.

SwarmAttacker works black-box, starting from a URL alone with no source code. A single planner agent makes every decision and dispatches waves of worker agents for reconnaissance and exploitation, plus on-demand web search. A summarizer condenses their traces into findings that loop back to the planner, for up to 50 rounds, until the planner verifies a result and writes the final report.

SwarmAttacker is free and open source; the only cost is the model. By default it signs in with the ChatGPT Plus or Pro account you already have, through the Codex backend, so there is no API key and no per-token bill. A run averages 2.14 million tokens, and when a plan's usage cap is hit the agent pauses and resumes rather than failing.

Install SwarmAttacker with one command: brew install joloooo/swarm/swarm on Homebrew, pipx install swarmattacker, or uv tool install swarmattacker. The command-line tool is called swarm. To use the default ChatGPT backend, install the Codex CLI and sign in with your ChatGPT account once; SwarmAttacker reuses that login, so no key needs to be generated or pasted.

SwarmAttacker solves 94% of the XBOW benchmark, 98 of 104 vulnerable web apps, in a single pass on GPT-5.5. The best of five human professionals reached 85% with roughly 40 hours per person, and XBOW's own self-reported score is also 85%. Earlier agents such as PentestGPT, VulnBot and PentestAgent score between 51% and 61% at their best-of-three peak.

A typical run finishes in about 15 minutes, the median solve time across the XBOW benchmark. Benchmark runs were capped at 40 minutes; when the clock runs out the agent stops and writes its report with whatever it found. Solve times are bimodal: most targets fall in the low-to-mid teens, and the harder ones need a second act past 20 minutes.

SwarmAttacker produces an evidence-backed penetration testing report you can hand to a team. When the agent verifies a finding, or the clock runs out, it aggregates the evidence its worker agents collected into a shareable report that documents the steps taken. Findings are captured in a structured form during the run, so the report reflects what was actually demonstrated, not a guess.

Safety filters cannot tell an authorized penetration test from an attack, so they refuse both. SwarmAttacker treats a refusal as a temporary state, not a verdict: it neutralizes loaded wording before a request is sent, retries the same request, reframes it, and finally hands it to a more permissive sibling model. On 411 hard refusals this ladder cleared 100%, and turning it off cost 22 benchmarks.

SwarmAttacker runs GPT-5.5 by default, with GPT-5.4 as the fallback model, through the Codex backend using your ChatGPT subscription. It also supports the OpenAI API with your own key, Anthropic Claude models, any hosted model via OpenRouter, and fully offline local models through Ollama or llama-server. The backend is a swap; the rest of the agent stays the same.

Run SwarmAttacker only against systems you own or are explicitly authorized to test. It is a tool for authorized penetration testing, and its refusal handling exists so that legitimate tests are not blocked, not to enable attacks on targets you have no permission to touch. The agent runs on your own machine and probes and exploits the target you name, so use a lab or staging copy, not production.