The Short Answer
Shannon is an open-source AI pentester that reads your source code, then exploits your running app to prove each finding. It changes the system it tests and sends code context to the model you choose. On ibl.ai, agents like it run where you own all the code and the data: your sandbox, your host allowlist, your model endpoint.
Shannon is built by Keygraph and sits at 51,031 GitHub stars as of November 3, 2026, with 5,941 forks. Its latest release, v3.5.0, shipped on October 27, 2026.
What is Shannon, the open-source AI pentester from Keygraph?
Shannon is an autonomous agent that pentests web applications and their APIs. Per its README, it maps the architecture, trust boundaries and data flows in your source code, then uses browser automation and command-line tools to attack the live application.
Its rule is "No exploit, no report": a finding appears only with a working proof of concept. It targets injection, XSS, SSRF, broken authentication and broken authorization, and Keygraph says a full run can take roughly 1 to 1.5 hours.
It runs from the command line or through an official GitHub Action and GitLab component, and can fail a pipeline when it exploits a vulnerability above a severity you set. Reports come out as PDF, Markdown, JSON and SARIF 2.1.0.
Is the Shannon AI pentester MIT licensed?
Shannon is not MIT licensed. The repository's license is the GNU Affero General Public License v3.0, and Keygraph sells commercial terms for private redistribution and managed-service use.
The difference is practical. AGPL-3.0 obliges anyone who modifies the program and lets others use it over a network to offer those users the source. A team that plans to wrap Shannon into an internal service should read the license, not a social post about it.
Keygraph also sells hosted Pro at $50 per active developer per month, per the README's editions table, with a self-hosted and air-gapped Enterprise edition at custom pricing.
Is Shannon new?
Shannon is not new, though it keeps shipping. GitHub shows the repository was created on September 27, 2025. TestingCatalog's coverage of the 3.0 release in September 2026 already put it past 47,000 stars.
Five releases followed between September 3 and October 27, 2026. The star count is a measure of attention over more than a year, not a sudden spike.
Why does an AI pentester like Shannon need a sandbox?
An AI pentester needs a sandbox because it acts on the system it tests. Shannon's own safety section says its exploitation agents "can create users, submit forms, mutate application state, trigger outbound requests, and otherwise affect the target system."
Keygraph's instruction is to use sandboxed, staging or local environments with disposable data, and never to point it at systems you lack authorization to test. It also says findings still require human review, because model-written reports can contain incorrect details.
That is a candid description of every agent with tools. It is the same containment question we examined in the Hugging Face intrusion, where evaluation agents escaped the sandbox meant to hold them.
Where does your source code go when an AI pentester runs?
Your source code goes wherever your model endpoint is. Shannon's README says Keygraph never receives your code or proxies model traffic, and that model requests "carry source and application context with them" straight to the provider you configure.
Anthropic, OpenAI, xAI and AWS Bedrock are built in. Shannon also runs on local models through Ollama, vLLM or LM Studio, and the README warns that a weaker model produces weaker pentests.
So the privacy decision is the model choice. A model-agnostic agent lets a security team keep code inside its own network by pointing it at a model it hosts, and trade some capability for that when it must.
Are attackers using the same kind of AI pentesting tool?
Attackers are using the same class of tool. CrowdStrike documented ARTEX, an open-source agentic pentesting framework, in an October 2026 campaign against South Korean financial organizations that ended in exfiltrated data.
On October 29 CrowdStrike reported a China-based group using ARTEX against more than 200 organizations, with post-exploitation confirmed at nine. We set out what that means for banks in Binance, Allium and AI agents in financial services.
The difference between Shannon and ARTEX is authorization and target, not technique. That is why the controls around the agent matter more than the agent.
How should a security team run agents like Shannon?
A security team should run an offensive agent inside boundaries it sets before the first scan. Four checks cover most of it.
- Written authorization and a named target. Shannon's README puts legal and ethical use on the operator. Record which hosts are in scope.
- A disposable environment. Staging with throwaway data, rebuilt after each run, because the agent changes state.
- An egress allowlist. The agent should reach the target and the model endpoint, and nothing else. On ibl.ai, an agent on a Virtual Machine Shell sandbox under a Custom Allowlist reaches only the hosts you name.
- A model you chose for the code it will see. Decide per repository whether source context may leave your network.
The same four checks apply to every agent with tools, not only pentesters. On ibl.ai you run them model-agnostic, with no per-seat pricing, and you can deploy anywhere from your own cloud to a fully air-gapped network.
Sources: star, fork, creation and release dates from the KeygraphHQ/shannon repository on November 3, 2026; capabilities, safety, providers, editions and pricing from its README; license from its LICENSE file; the 47,000-star figure from TestingCatalog; ARTEX campaigns from CrowdStrike's October 7 and October 29 reports. The brief described Shannon as MIT licensed and newly at 48,000 stars; the repository shows AGPL-3.0 and a project dating from September 2025.