SwarmAttacker vs Pentest Swarm AI

Pentest Swarm AI is an AGPL-3.0 Go command-line pentest harness maintained by Armur AI, a small Techstars and Outlier Ventures-backed startup led by Akhil Sharma, who wrote the large majority of its commits. The current Go codebase began in March 2026 and was relicensed from Apache to AGPL that May. It has around 2,400 stars and one tagged release from May 2026. Because its name collides with SwarmAttacker's positioning, it is worth being precise about what it is.

The tool runs four LLM agents, recon, classifier, exploit and report, over a library of about 28 wrapped scanners such as subfinder, nuclei, nmap and sqlmap. The default mode is a sequential five-phase pipeline; an experimental swarm flag switches to a scheduler where each agent runs in its own goroutine and reacts to findings on a shared in-memory blackboard, with total concurrency capped at seven handlers. Marketing copy describes dozens or eight agents; the code registers four.

Model support covers Claude by default, any OpenAI-compatible endpoint, Gemini and local Ollama or LM Studio, the last two needing no key. Refusal handling exists as phrase-based detection with a strict re-prompt and a fallback provider, but it activates only when a fallback is configured and not on streaming calls. Customisation is via YAML playbooks and tool definitions; system prompts are compiled into the binary. No benchmark results are published, and a user-filed issue reports the only shipped release silently returning zero findings due to a parsing bug fixed but unreleased.