SwarmAttacker vs hackingBuddyGPT

hackingBuddyGPT is an MIT-licensed Python framework from TU Wien's IPA-Lab, led by Andreas Happe and Jürgen Cito, whose stated goal is helping ethical hackers use LLMs in fifty lines of code or less. Rather than a turnkey scanner, it supplies the plumbing: LLM connectivity through LiteLLM with OpenRouter as the default, SSH, shell and HTTP capabilities, run limits on rounds, tokens, dollars and wall-clock time, and structured traces, so researchers can write their own agents, which the project calls use-cases.

Shipped use-cases cover Linux and Windows privilege escalation with ground-truth root verification and a Docker-fleet benchmark launcher, three web-testing agents including one that delegates to bounded sub-agents, an OpenAPI-driven REST API tester, and an Active Directory assumed-breach agent built on a planner and executor design. The code base is fully asynchronous and requires Python 3.13 or newer.

Its evidence base is academic: a 2023 FSE paper, the 2026 Empirical Software Engineering article "LLMs as Hackers" with a twelve-machine privilege-escalation benchmark on which GPT-4-Turbo reached 33 to 83 percent against a human baseline of 75, and a December 2025 thesis that ran nine models through the web agents on two custom OWASP Top 10 applications, where Claude Sonnet 4.5 and GPT-5.1 found 77 to 81 percent of the flags. The web agents hunt configurable capture-the-flag markers and the documentation describes web testing as exploratory; cloud safety filters are acknowledged but not handled.

Development remains active, with commits in late August 2026 and around 1,200 stars, although the last tagged release dates from August 2024. The target users are security researchers and students building or benchmarking agents.