-
Notifications
You must be signed in to change notification settings - Fork 0
ai security pentesting
Nicolas Cravino edited this page Apr 12, 2026
·
8 revisions
id: ai-security-pentesting title: AI Security & Pentesting tags: [security, pentesting, langgraph, llm, mlx, local-inference] created: 2026-04-11 updated: 2026-04-11 freshness: fresh
The sw30labs AI Security & Pentesting portfolio spans four repositories covering LLM integrity testing, regulatory intelligence for global pentest compliance, autonomous pentesting research, and enterprise AI-assisted pentesting specifications. Together they form a research-to-practice pipeline: from threat hypothesis (TSLIT) to regulatory landscape (RegIntel) to tooling research (Strix Research) to enterprise specification (agentic-ai-pentesting).
- TSLIT tests for combined affiliation bias AND time-based logic bombs in non-US-origin LLMs using a 32-scenario × 15-date matrix (~3,840 interactions per model). ^src:tslit
- RegIntel maintains a regulatory inventory across 20+ jurisdictions with a mandatory reflection quality gate — every new regulation must pass local LLM validation (Qwen 3.5 122B via MLX) before reaching the database. ^src:pentest-regulatory-intel
- RegIntel uses a hybrid model strategy: cloud LLM (GPT-5.4-mini) for research/validation, local MLX model for reflection/persistence. ^src:pentest-regulatory-intel
- Strix Research documents both the official Strix platform and a community fork with a distributed Graph-of-Agents architecture for multi-target parallel pentesting. ^src:strixresearch
- The agentic-ai-pentesting repo provides two complementary approaches: Plan A (fully autonomous with Docker sandbox + Temporal orchestration) and Plan B (50/50 co-pilot with Burp Suite + Claude API, 3021-line prompt library). ^src:agentic-ai-pentesting
- All four repos are companion materials for the book "AI Agents in Cybersecurity" by Nicolas Cravino. ^src:agentic-ai-pentesting
- How do TSLIT findings feed into RegIntel's regulatory recommendations?
- What is the integration path between Strix and the Plan A autonomous platform specification?
- oscal-compliance (OSCAL frameworks provide compliance context for pentesting)
- agentic-frameworks (shared LangGraph patterns)
Published articles related to AI security and pentesting:
- The Rise of Agentic Security Consulting — 2026-01-29. ^src:rise-agentic-security
- Agentic AI Pentesting for Layer 7 — 2026-02-03. ^src:agentic-pentesting-layer7
- The 72-Hour Civilization — 2026-02-06. ^src:72-hour-civilization-agents
- The Intelligence Event Horizon — 2026-02-02. ^src:intelligence-event-horizon
- Understanding AI Agent Security: Two Analogies — 2026-02-21. ^src:understanding-agent-security-analogies
- AI Agent Security Governance — 2025-11-16. ^src:ai-agent-security-governance
- AI-Generated Code: A Zero Trust Approach — 2023-05-24. ^src:ai-generated-code-zero-trust
- Digital Twins for IR Testing — 2023-12-22. ^src:digital-twins-incident-response
- Revolutionizing Cyber Risk Advisory — 2023-04-23. ^src:revolutionizing-cyber-risk-advisory-ai
- Safeguarding Datasets in the LLM Era — 2023-06-23. ^src:safeguarding-datasets-llm-era
- Do We Need a New OSI Layer for NL? — 2024-11-20. ^src:osi-model-natural-language-layer