# Pentest Swarm AI

An open-source, self-hosted swarm of AI agents that runs autonomous penetration tests against APIs and web applications, chaining and exploiting vulnerabilities such as BOLA/IDOR, JWT forgery and SSRF rather than only scanning for them, for use in authorized testing.

Pentest Swarm AI is a self-hosted, open-source alternative to a hosted penetration-testing service called XBOW. Dozens of AI agent specialists work a target concurrently, coordinating through a shared blackboard so that a finding immediately wakes whichever agent it is relevant to, and it is built in Go with more than seven native security tools.

Rather than only scanning, the agents chain and exploit vulnerabilities such as BOLA/IDOR, JWT forgery, mass assignment, SSRF and injection, building and scoring attack paths and capturing evidence before writing a report. It supports bug bounty, continuous monitoring and CTF modes, and is aimed at pentesters, bug bounty hunters, red teamers and security researchers running authorized tests.

It can run against Claude, any OpenAI-compatible provider including Together AI's hosted models, security-tuned open models, or fully local models through Ollama or LM Studio.

Website: https://github.com/Armur-Ai/Pentest-Swarm-AI