--- title: "Shannon, the Open-Source AI Pentester: What a Security Team Should Know Before Running It" slug: "shannon-open-source-ai-pentester-sandbox-source-code" author: "ibl.ai" date: "2026-11-03 12:00:00" category: "Premium" topics: "Shannon AI pentester, Keygraph, AI penetration testing, agentic pentesting, AGPL-3.0, CI/CD security testing, AI agent sandbox, source code privacy, self-hosted AI agents, model-agnostic AI, ARTEX, application security" summary: "Shannon, Keygraph's open-source AI pentester, passed 51,000 GitHub stars by November 2026. It is AGPL-3.0 licensed, not MIT, it mutates the systems it tests, and it sends your source context to whichever model you point it at. What that means for running offensive agents safely." banner: "" thumbnail: "" linkedin: | Shannon, Keygraph's open-source AI pentester, is past 51,000 GitHub stars. It reads your source code, then runs real exploits against your running app, and reports only what it can prove. Two things the posts sharing it tend to get wrong. It is AGPL-3.0, not MIT. That matters to anyone planning to modify it and offer it as a service. And it is not new. The repository dates from September 2025; it had passed 47,000 stars before its 3.0 release in September 2026. The part worth reading is its own safety section. Its exploitation agents can create users, submit forms and change application state, so Keygraph says to run it only against staging or disposable data. And every model request carries your source and application context to whichever provider you configure. That is the general rule for any agent that acts: decide where it runs, which hosts it can reach, and which model sees your code, before you give it a target. Attackers already run the same class of tool. CrowdStrike documented ARTEX being used against South Korean banks in October. #iblai #CyberSecurity #AppSec #AIAgents #Pentesting --- ## The Short Answer **Shannon is an open-source AI pentester that reads your source code, then exploits your running app to prove each finding. It changes the system it tests and sends code context to the model you choose. On ibl.ai, agents like it run where you own all the code and the data: your sandbox, your host allowlist, your model endpoint.** Shannon is built by Keygraph and sits at [51,031 GitHub stars](https://github.com/KeygraphHQ/shannon) as of November 3, 2026, with 5,941 forks. Its latest release, v3.5.0, shipped on October 27, 2026. ## What is Shannon, the open-source AI pentester from Keygraph? Shannon is an autonomous agent that pentests web applications and their APIs. Per [its README](https://github.com/KeygraphHQ/shannon), it maps the architecture, trust boundaries and data flows in your source code, then uses browser automation and command-line tools to attack the live application. Its rule is "No exploit, no report": a finding appears only with a working proof of concept. It targets injection, XSS, SSRF, broken authentication and broken authorization, and Keygraph says a full run can take roughly 1 to 1.5 hours. It runs from the command line or through an official GitHub Action and GitLab component, and can fail a pipeline when it exploits a vulnerability above a severity you set. Reports come out as PDF, Markdown, JSON and SARIF 2.1.0. ## Is the Shannon AI pentester MIT licensed? Shannon is not MIT licensed. The repository's license is the [GNU Affero General Public License v3.0](https://github.com/KeygraphHQ/shannon/blob/main/LICENSE), and Keygraph sells commercial terms for private redistribution and managed-service use. The difference is practical. AGPL-3.0 obliges anyone who modifies the program and lets others use it over a network to offer those users the source. A team that plans to wrap Shannon into an internal service should read the license, not a social post about it. Keygraph also sells hosted Pro at $50 per active developer per month, per the README's editions table, with a self-hosted and air-gapped Enterprise edition at custom pricing. ## Is Shannon new? Shannon is not new, though it keeps shipping. GitHub shows the repository was created on September 27, 2025. [TestingCatalog's coverage](https://www.testingcatalog.com/shannon-3-0-ai-pentester-gets-through-aikido-and-xbow.md) of the 3.0 release in September 2026 already put it past 47,000 stars. Five releases followed between September 3 and October 27, 2026. The star count is a measure of attention over more than a year, not a sudden spike. ## Why does an AI pentester like Shannon need a sandbox? An AI pentester needs a sandbox because it acts on the system it tests. Shannon's own safety section says its exploitation agents "can create users, submit forms, mutate application state, trigger outbound requests, and otherwise affect the target system." Keygraph's instruction is to use sandboxed, staging or local environments with disposable data, and never to point it at systems you lack authorization to test. It also says findings still require human review, because model-written reports can contain incorrect details. That is a candid description of every agent with tools. It is the same containment question we examined in [the Hugging Face intrusion](/blog/openai-eval-agents-hugging-face-intrusion-containment-you-own), where evaluation agents escaped the sandbox meant to hold them. ## Where does your source code go when an AI pentester runs? Your source code goes wherever your model endpoint is. Shannon's README says Keygraph never receives your code or proxies model traffic, and that model requests "carry source and application context with them" straight to the provider you configure. Anthropic, OpenAI, xAI and AWS Bedrock are built in. Shannon also runs on local models through Ollama, vLLM or LM Studio, and the README warns that a weaker model produces weaker pentests. So the privacy decision is the model choice. A model-agnostic agent lets a security team keep code inside its own network by pointing it at a model it hosts, and trade some capability for that when it must. ## Are attackers using the same kind of AI pentesting tool? Attackers are using the same class of tool. CrowdStrike [documented ARTEX](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/), an open-source agentic pentesting framework, in an October 2026 campaign against South Korean financial organizations that ended in exfiltrated data. On October 29 CrowdStrike reported a China-based group using ARTEX against more than 200 organizations, with post-exploitation confirmed at nine. We set out what that means for banks in [Binance, Allium and AI agents in financial services](/blog/binance-allium-breach-credentials-agent-security-financial-services). The difference between Shannon and ARTEX is authorization and target, not technique. That is why the controls around the agent matter more than the agent. ## How should a security team run agents like Shannon? A security team should run an offensive agent inside boundaries it sets before the first scan. Four checks cover most of it.
  1. Written authorization and a named target. Shannon's README puts legal and ethical use on the operator. Record which hosts are in scope.
  2. A disposable environment. Staging with throwaway data, rebuilt after each run, because the agent changes state.
  3. An egress allowlist. The agent should reach the target and the model endpoint, and nothing else. On ibl.ai, an agent on a Virtual Machine Shell sandbox under a Custom Allowlist reaches only the hosts you name.
  4. A model you chose for the code it will see. Decide per repository whether source context may leave your network.
The same four checks apply to every agent with tools, not only pentesters. On ibl.ai you run them model-agnostic, with no per-seat pricing, and you can deploy anywhere from your own cloud to a fully air-gapped network. *Sources: star, fork, creation and release dates from the [KeygraphHQ/shannon repository](https://github.com/KeygraphHQ/shannon) on November 3, 2026; capabilities, safety, providers, editions and pricing from its README; license from its [LICENSE file](https://github.com/KeygraphHQ/shannon/blob/main/LICENSE); the 47,000-star figure from [TestingCatalog](https://www.testingcatalog.com/shannon-3-0-ai-pentester-gets-through-aikido-and-xbow.md); ARTEX campaigns from [CrowdStrike's October 7](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) and [October 29](https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/) reports. The brief described Shannon as MIT licensed and newly at 48,000 stars; the repository shows AGPL-3.0 and a project dating from September 2025.* ## Why does owning the AI stack matter? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.