Scanners-Box 每日 AI 工具推荐 Scanners-Box Daily AI Tool Picks

AI 红队测试框架与 Agent AI Red Teaming Frameworks & Agents

共 7 个工具 · 专栏不定期更新 7 tools · new issues as they're written

成熟的一体化渗透 Agent 和可以二次改造的基础框架都收在这里。看点在编排（角色分工、状态图、黑板）和收敛条件：它凭什么认为已经挖完了。Mature turnkey pentest agents, plus foundational frameworks you can build your own on. The interesting parts are the orchestration — roles, state graphs, blackboards — and the stopping condition: what makes it believe it is done.

DeepTeam DeepTeam DeepTeam GitHub stars 第 023 期 · 2026.10.28 No. 23 · Oct 28, 2026

红队测试 + 生产护栏两半都包：一个 LLM 现写攻击、一个 LLM 判定、失败带 CVSS；测出来的偏见/PII/提示注入，线上挂 7 个守卫直接拦 Red teaming and production guardrails in one framework: one LLM writes the attacks, another judges each case, failures carry CVSS — and the bias/PII/prompt injection the tests surface get blocked live by 7 guards

36 类 251 型漏洞面（Agentic 占 11 类），22 种单轮 + 5 种多轮攻击（Crescendo/Linear/Tree/Sequential/BadLikertJudge）。callback 契约把 retrieval_context 和 tools_called 交给裁判，RAG 投毒与工具滥用才测得出来。读码三个坑：拒答即过（16 前缀 + 24 标记，仅英文，中文拒答会被误判）；risks.py 只映射 19 个类型族，Agentic 全落 Others；CVSS 的 impact 恒为 MEDIUM（源码注释承认未按漏洞类型推导）。护栏 7 个（输入/输出两侧挂守卫），LLM 判定 safe/borderline/unsafe，任一守卫非明确 safe 即 breached、出错按 unsafe（fail-closed），sample_rate 降采样控成本。默认 ignore_errors=True、自动上传 Confident AI 并开浏览器。 36 classes / 251 vulnerability types (11 in Agentic), 22 single-turn plus 5 multi-turn attacks (Crescendo/Linear/Tree/Sequential/BadLikertJudge). The callback contract hands retrieval_context and tools_called to the judge, which is what makes RAG poisoning and tool abuse testable at all. Three gotchas from the source: refusals auto-pass (16 prefixes + 24 markers, English-only — Chinese refusals get mis-scored); risks.py maps only 19 type families and all Agentic types land in Others; CVSS impact is always MEDIUM (a source comment admits it is not yet derived from the vulnerability type). Guardrails: 7 guards on inputs and outputs, LLM verdicts safe/borderline/unsafe, any guard not explicitly safe sets breached, guard errors count as unsafe (fail-closed), sample_rate sampling to control cost. Defaults: ignore_errors=True and auto-upload to Confident AI with a browser popup.
https://github.com/confident-ai/deepteam
Dark-Moon Dark-Moon Dark-Moon GitHub stars 第 010 期 · 2026.9.30 No. 10 · Sep 30, 2026

把真实 IP / 主机 / URL / 凭证在本地换成确定性占位符、只在工具执行那一刻还原：50 个专家 agent + 140+ 真实工具的自主渗透平台 Real IPs, hosts, URLs and credentials become deterministic local placeholders, restored only at tool-execution time: an autonomous pentest platform with 50 specialist agents and 140+ real tools

Privacy Gateway 的可逆本地 tokenization 在主流程里而非插件位，占位符确定性所以模型仍能做关联推理；Docker Compose 全栈、可全本地模型跑。短板：GPL-3.0、Pro 版存在感过强、57 漏洞 benchmark 是云端 Claude 跑的、社区样本小。 The Privacy Gateway's reversible local tokenization sits in the main flow rather than a plugin slot, and deterministic placeholders let the model still correlate. Docker Compose full stack, runs fully on local models. Caveats: GPL-3.0, heavy Pro-tier presence, the 57-vuln benchmark was run on cloud Claude, small community sample.
https://github.com/ASCIT31/Dark-Moon
LuaN1ao LuaN1ao LuaN1ao GitHub stars 第 009 期 · 2026.9.29 No. 9 · Sep 29, 2026

把每条渗透结论钉回证据链：P-E-O 三角色 + 三图分离 + Evidence→Hypothesis→Vulnerability→Exploit 因果链 Pinning every pentest finding to evidence: Planner-Executor-Observer roles + three graph separations + an enforced Evidence → Hypothesis → Vulnerability → Exploit chain

TypeScript + Pi SDK 重写的 v2 自主渗透 Agent：证据引用是 schema 层面的硬约束（没有 evidence 引用就写不进 Vulnerability / Exploit 节点）。Docker 出网收口在内核态，scope 校验确定性拒绝臆造网段。短板：AGPL-3.0、Node.js 25+、v2 benchmark 还没发、高危动作没有审批闸门。 v2 autonomous pentest agent rewritten in TypeScript on the Pi SDK — evidence references are an enforced schema constraint (no Vulnerability / Exploit node without evidence). Docker-based egress gating at the kernel layer, and deterministic scope checks reject any fabricated CIDR. Caveats: AGPL-3.0, Node.js 25+ required, no v2 benchmark published yet, and no human approval gate on high-risk actions.
https://github.com/SanMuzZzZz/LuaN1aoAgent
PentAGI PentAGI PentAGI GitHub stars 第 004 期 · 2026.9.21 No. 4 · Sep 21, 2026

全自主渗透平台：Docker 沙箱里跑 20+ 工具，13 个 agent 角色分工，四道闸门防止跑飞 A fully autonomous pentesting platform: 20+ tools in a Docker sandbox, 13 specialized agent roles, and four supervision gates to stop runaway runs

Go 写的全自主渗透平台，五层结构（核心 / 知识图谱 / 监控 / 沙箱工具 / 分析），13 个 agent 角色由四道闸门（调用上限 / Reflector / 执行监控 / 任务规划）监管。官方维护 vLLM + Qwen3.5-27B-FP8 气隙部署指南。 Autonomous pentesting platform in Go with five layers (core / knowledge graph / monitoring / sandbox tools / analytics), 13 agent roles supervised by four gates (call caps / Reflector / execution monitoring / task planning). Ships an official vLLM + Qwen3.5-27B-FP8 air-gapped deployment guide.
https://github.com/vxcontrol/pentagi
Cairn Cairn Cairn GitHub stars 第 003 期 · 2026.9.20 No. 3 · Sep 20, 2026

通用状态空间搜索引擎：不定义角色与工作流，给起点和终点，让 Agent 在黑板上自己搜路 A general state-space search engine: no roles, no workflows — hand it an origin and a goal and let agents find the path on a shared blackboard

黑板架构 + 事实/意图图，只有 Fact / Intent / Hint 三个原语；Worker 跑 OODA 循环，靠 Stigmergy 间接协作，角色在运行时涌现而非写死。腾讯云黑客松 AI 渗透挑战赛 610 队里唯一 AK（54/54）。 State-space search engine built on a blackboard + fact-intent graph with three primitives (Fact, Intent, Hint). Workers run OODA loops and coordinate via stigmergy; roles emerge at runtime. The only team to AK (54/54) at the Tencent Cloud AI Pentesting Hackathon out of 610.
https://github.com/oritera/Cairn
Shannon Shannon Shannon GitHub stars 第 002 期 · 2026.9.19 No. 2 · Sep 19, 2026

AI 渗透测试 Agent：读源码找攻击面，再真打一遍验证，只有跑通 PoC 的漏洞才进报告 An AI pentesting agent: read the source, map attack paths, then prove every finding with a real exploit — no PoC, no report.

六段流水线：侦察 + 代码分析双流候选 → 归并去重 → 利用 Agent 真打 → 打不穿就丢 → PDF/Markdown/SARIF 报告。原生接 GitHub Actions，只有 exploited 的发现才卡流水线。AGPL-3.0，会改目标状态，只打 staging。 Six-stage pipeline: recon and code analysis produce candidates, dedup, exploitation agents attack the live app, undemonstrated findings get discarded, and survivors become PDF / Markdown / SARIF. Native GitHub Actions; only exploited findings gate the pipeline. AGPL-3.0, staging only.
https://github.com/KeygraphHQ/shannon
CyberStrikeAI CyberStrikeAI CyberStrikeAI GitHub stars 第 001 期 · 2026.9.18 No. 1 · Sep 18, 2026

AI 原生的安全执行中枢：把自然语言意图转成受治理的行动，并把证据沉淀成可复用的运营记忆 An AI-native security execution hub: turns natural-language intent into governed action and bakes evidence into reusable operational memory.

Go + Eino 编排，100+ YAML 工具配方 + MCP，内置审批、调用前正则拦截、RBAC 与审计日志。它的差异不在能调多少工具，而在于敢不敢让 Agent 真的动手。 Go + Eino orchestration with 100+ YAML tool recipes plus MCP, plus first-class approval, pre-call regex intercept, RBAC and audit logs. Its edge isn't how many tools it can call — it's whether it dares to let the agent really act.
https://github.com/AIPentest/CyberStrikeAI

其他分类Other categories

AI-Generated Code Security EvaluationAI-Generated Code Security Evaluation AI 基础设施攻击面发现AI Infrastructure Attack Surface Discovery AI 安全验证标准与规范AI Security Verification Standards AI 智能体运行时管控AI Agent Runtime Controls Agent 工作流安全工具箱Security Toolkits for Agentic Workflows AI 智能体与应用安全审计Security Auditing for AI Agents & Apps Agent 技能：漏洞发现与修复Agent Skills for Vulnerability Discovery & Remediation Agent Skills 安全审计Security Auditing for Agent Skills LLM 驱动的漏洞扫描器LLM-Powered Vulnerability Scanners

← 回专栏看全部期号 ← Back to all issues