SwarmAttackerHow it works
One planner.
A swarm of specialists.
SwarmAttacker starts from a single URL and nothing else. Instead of walking a target through one fixed checklist, it sends out waves of workers that each try a different way in, all at once.
The parts
Six roles, one loop.
SwarmAttacker is built on LangGraph. Work flows from the planner out to the workers and back, up to 50 rounds, inside a 40-minute budget per target.
Planner
The only decision-maker. It ranks skills, dispatches each wave of workers, reads their findings, and decides what to try next.
Recon
Two workers map the target at once: ports and services with one, web content and endpoints with the other.
Executors
The swarm. Several specialist workers run in parallel, each carrying one attack skill and its own tools.
Summarizer
Digests each worker's full trace into structured, evidence-backed findings before the planner ever sees raw output.
Web search
On-demand research. When a skill hits a knowledge gap, it reads several sources and returns a tight summary.
Report
Writes the final penetration-testing report once the target is cracked or the clock runs out.
Slow, then swarm
It watches before it swarms.
For the first 10 minutes the planner keeps its waves small, 4 workers at a time, so it can watch what each probe returns and replan often. This is the careful part: mapping the app, forming a theory, ruling out dead ends.
Once real leads exist, it opens up to 6 workers per wave and fires them in parallel, a swarm converging on the ways in it has found. Most easy targets fall in the first act; the hard, multi-step ones get the wider fan-out.
New attacks are writing, not engineering.
Every technique the agent knows is a plain-text skill file, written to the open agentskills.io standard, the same format Claude Code and Codex use. SwarmAttacker ships with 60+ of them, one per vulnerability class.
Teaching it a new class is writing a few sentences of how-to and adding one line to make it dispatchable. No code change, no vector index to rebuild. Heavy payload libraries stay in reference files the worker loads only when it needs them.
--- name: my-new-attack description: | Use: when the target reflects a template Signals: {{7*7}} renders as 49 Pair with: recon, waf-bypass --- # How to test for this Send the probe, read the response, and...
Powered by your ChatGPT plan
By default it drives GPT-5.x through the same backend the Codex CLI uses. Sign in once with your ChatGPT Plus or Pro account and there is no API key and no per-token bill. It also runs against the OpenAI API, Anthropic, OpenRouter, or a local open-source model, so you are never locked to one provider.
Refusals, handled
Safety filters cannot tell an authorized test from a real attack, so they refuse both. SwarmAttacker phrases every request as a neutral diagnostic, and when a refusal still slips through it climbs a recovery ladder: retry, then swap to a more permissive sibling model. In testing, that ladder cleared every refusal. It is the single most important part of the system.
Turn a URL into a security report.
SwarmAttacker is open source and runs on the ChatGPT subscription you already pay for. Clone it, point it at a target you own, and watch the swarm work.