Skip to content

ai security pentesting

Jump to bottom
Nicolas Cravino edited this page Apr 15, 2026 · 8 revisions

id: ai-security-pentesting title: AI Security & Pentesting tags: [security, pentesting, langgraph, llm, mlx, local-inference] created: 2026-04-11 updated: 2026-04-13 freshness: fresh

AI Security & Pentesting

Summary

The sw30labs AI Security & Pentesting portfolio spans four repositories covering LLM integrity testing, regulatory intelligence for global pentest compliance, autonomous pentesting research, and enterprise AI-assisted pentesting specifications. Together they form a research-to-practice pipeline: from threat hypothesis (TSLIT) to regulatory landscape (RegIntel) to tooling research (Strix Research) to enterprise specification (agentic-ai-pentesting).

Key claims

  • NVD Extractor queries the National Vulnerability Database API for critical-severity network-attack-vector CVEs over the last 360 days, filtering for Linux, Windows, and external-facing API vulnerabilities with LLM-optimized output. ^src:nvd-extractor
  • TSLIT tests for combined affiliation bias AND time-based logic bombs in non-US-origin LLMs using a 32-scenario × 15-date matrix (~3,840 interactions per model). ^src:tslit
  • RegIntel maintains a regulatory inventory across 20+ jurisdictions with a mandatory reflection quality gate — every new regulation must pass local LLM validation (Qwen 3.5 122B via MLX) before reaching the database. ^src:pentest-regulatory-intel
  • RegIntel uses a hybrid model strategy: cloud LLM (GPT-5.4-mini) for research/validation, local MLX model for reflection/persistence. ^src:pentest-regulatory-intel
  • Strix Research documents both the official Strix platform and a community fork with a distributed Graph-of-Agents architecture for multi-target parallel pentesting. ^src:strixresearch
  • The agentic-ai-pentesting repo provides two complementary approaches: Plan A (fully autonomous with Docker sandbox + Temporal orchestration) and Plan B (50/50 co-pilot with Burp Suite + Claude API, 3021-line prompt library). ^src:agentic-ai-pentesting
  • All four repos are companion materials for the book "AI Agents in Cybersecurity" by Nicolas Cravino. ^src:agentic-ai-pentesting

Open questions

  • How do TSLIT findings feed into RegIntel's regulatory recommendations?
  • What is the integration path between Strix and the Plan A autonomous platform specification?

Related

Articles

Published articles related to AI security and pentesting:

Sources

Home | Index | Sitemap | Sitemap-Stacks | SCHEMA | Log

Clone this wiki locally