AI Security

Self-hosted AI security testing platform for authorized pentesting and bug bounty workflows, with a local web UI, live agent telemetry, verified findings, and branded PDF reports.

grith is a Linux security proxy for AI coding agents that supervises file, process, and network actions at the OS level before they execute. It supports tools like Claude Code, Codex, Aider, Cline, and Goose, with local audit logging and profiles for common agent workflows.

Open-source, agentic AI code security tool from Capital One that analyzes source code for exploitable defects, traces attack paths, and proposes targeted remediations.

AI-native application protection platform with autonomous LLM pentesting, proof-of-concept exploit findings, and a full API-driven workflow for scans, reporting, and remediation.

AI code security scanner that reviews a repository, flags exploitable issues, and provides a scoped fix prompt for each finding.

A hands-on lab toolkit for Docker and container security, covering CIS checks, image hardening, signing, SBOMs, admission control, runtime security, and AI context-poisoning defenses.

A prompt-injection capture-the-flag arena for testing how AI agents behave under attack. Users can play challenges, create guarded agents, add optional guards and sandboxed tools, and track scores on a leaderboard.

An interactive CTF-style challenge where users try to break or exfiltrate data from sandboxed AI agents running in Declaw’s isolated runtime.

A security product for Claude Code that reviews application architecture inside the IDE via MCP, with contextual assessments, prioritized mitigations, and continuous re-checks as the codebase changes.

Anthropic research post showing Claude applied to attack surface analysis and reduction across 25 open-source codebases, with concrete findings and security-focused methods.

A deterministic security scanner and adversarial flight simulator for AI agents, built for red-teaming LLM workflows and MCP-compatible setups.

A Blue41 case study on how a banking AI assistant could be abused through indirect prompt injection, and what mitigation layers help reduce the risk.

Jo is a secure programming language designed to help catch prompt injection and other unsafe behavior at compile time by enforcing explicit capability boundaries. The repository shows the language’s security model, code examples, installation flow, and current project status.

An explainer of Cisco’s open-source Project Quarry, a rule language and plugin setup for scanning agent conversations for risky behavior. It describes the rule engine, the Claude Code/Codex plugin, data flow, and what the tool does not monitor.

A comparison guide covering prompt injection detection and defense tools for enterprise AI agents, including production screening, red-team testing, guardrails, and action-boundary controls.

Giskard presents an AI red-teaming and continuous evaluation platform focused on finding hallucinations, security issues, and agent vulnerabilities. The page explains how it compares tools for agent-level testing, regression checks, and guardrail workflows.

A research writeup from AgentSploit analyzing 1,384 tools across 28 MCP servers, highlighting how tool descriptions, source tools, and sink tools create an attack surface for agents.

A Reco security research article showing an AI-powered agent that maps Salesforce Experience Cloud sites, probes exposed objects and Apex methods, and attempts autonomous exploitation to find data exposure.