SwarmAttacker
Autonomous penetration testing
SwarmAttacker
Point it at a URL. A swarm of language-model agents maps the target, finds vulnerabilities, and reports what it found, running on the ChatGPT subscription you already have.
No API keys, no metered bills
Runs on one ChatGPT subscription.
Most AI security tools burn through paid API credits. SwarmAttacker signs in once with your ChatGPT Plus or Pro account and drives GPT-5.x through the same backend the Codex CLI uses. No API key, no per-token invoice. Prefer something else? It also speaks to the OpenAI API, Anthropic, OpenRouter, or a fully local model.
via the Codex backend — no API key
bring your own key
Claude models
any hosted model
Ollama / llama-server, fully offline
What it is
A penetration tester that thinks in parallel.
True black-box
It starts from a URL or IP with no credentials and no source access, the same blind position a real attacker has.
A swarm, not a script
A planner dispatches waves of specialist workers that probe different vulnerability classes at the same time, instead of marching through one fixed checklist.
Skills you can add in minutes
Every attack technique is a plain-text skill file. Teaching the agent a new class is writing a few sentences, not shipping code or rebuilding an index.
Refusal-proof by design
Safety filters refuse authorized tests too. SwarmAttacker keeps working through neutral phrasing, retries, and a permissive-model fallback that clears every refusal.
Chains multi-step exploits
It recovers credentials on its own, then reuses them across the app for IDOR, privilege escalation, and business-logic abuse.
Runs anywhere
A Python agent on LangGraph. Bring a ChatGPT subscription, an API key, or a local model, and run it on your own machine.
Recon
Two workers map the target at once: ports and services on one side, web content and endpoints on the other.
Swarm
The planner fans out waves of specialist workers, each carrying one attack skill, all probing the target in parallel.
Report
Findings come back as structured, evidence-backed hypotheses, then get written up as a penetration-testing report.
How it stacks up
94% of the suite, in a single pass.
On the 104-app XBOW benchmark, SwarmAttacker solves more than the best published agents and edges out the best of five human professionals, who needed about 40 hours each.
XBOW solve rate across penetration-testing agents
Reported solve rates. SwarmAttacker is a single black-box pass on GPT-5.5; several others are best-of-three peaks. See the results page for the full picture.
From the lab
What building it taught us.
Which AI models refuse to do security work
We replayed 411 real flagged requests through 16 models. Two frontier models block almost everything; the entire open-weight field blocks nothing.
Read
Our AI out-scored professional pentesters, in 15 minutes not 40 hours
On the XBOW benchmark it solved 94% to the best human's 85%, and cracked each target in a median of 15 minutes instead of a multi-day engagement.
Read
It's not the model, pal. It's the agent.
Same weights, wildly different results. Our first build barely cleared half; after tuning the agent around the exact same model, it hit 94%.
ReadTurn a URL into a security report.
SwarmAttacker is open source and runs on the ChatGPT subscription you already pay for. Clone it, point it at a target you own, and watch the swarm work.