An autonomous AI agent for bug bounty hunting, penetration testing, and security research — with 769+ cybersecurity skills, multi-LLM reasoning, persistent memory, and swarm orchestration.
| Capability | Dark Agent | Typical Alternatives |
|---|---|---|
| Integrated security tools | 94 built-in | 10–30 (often external) |
| Cybersecurity skills (YAML/STIX) | 769+ curated skills | None / few ad-hoc prompts |
| Multi-LLM reasoning | OpenAI + Claude + Ollama (auto-failover) | Single provider |
| Persistent memory & learning | SQLite + vector store, pattern extraction | Session-only |
| Multi-agent orchestration | Router → Coordinator → Super Agent | Single-threaded |
| Vulnerability chaining | Graph-based (NetworkX), CVSS-weighted | Manual |
| Smart contract auditing | Solidity + Move + Vyper | Rare / separate tools |
| Self-healing runtime | Health monitors, exponential backoff | N/A |
| Auto-update | Built-in (GitHub releases + Docker) | Manual |
Not a scanner wrapper. Dark Agent reasons over findings, chains vulnerabilities, writes exploits, and learns from every engagement.
| Category | Count | Highlights |
|---|---|---|
| Reconnaissance | 18 | Subdomain, port, directory, API, GitHub, DNS, WAF detection |
| Vulnerability Testing | 48 | XSS, SQLi, SSRF, SSTI, XXE, IDOR, JWT, RCE, GraphQL, NoSQL, LFI, etc. |
| Self-Learning | 3 | Outcome tracking, pattern mining, technique scoring |
| Memory & Storage | 4 | SQLite vault, vector embeddings, finding deduplication |
| General Utilities | 21 | Code exec, shell, web fetch, file ops, analysis, reporting |
- OpenAI — GPT-4o, GPT-4-turbo, GPT-3.5
- Anthropic — Claude Opus, Sonnet, Haiku
- Ollama — Local models (Llama 3, Mistral, CodeLlama, etc.)
- Automatic provider failover on rate limits / errors
- SQLite-backed findings vault with deduplication
- Working memory for active sessions
- Vector embeddings for semantic recall
- Pattern learning → technique effectiveness scores
| Agent | Role |
|---|---|
| Recon Agent | Deep surface mapping (subdomains, APIs, JS, cloud assets) |
| Chain Builder | Auto-discovers vuln chains (IDOR → Admin, SSRF → Cloud metadata, etc.) |
| Triage Agent | Severity classification, false-positive suppression |
| Validator | Active verification (PoC execution, screenshot, diff) |
| Report Writer | Professional markdown/PDF/HTML with evidence |
| Web3 Auditor | Smart contract static + dynamic analysis (Slither, Mythril, Foundry) |
| System | Purpose |
|---|---|
chain_engine.py |
Graph-based vuln chaining, 10+ templates, CVSS multipliers |
exploit_developer.py |
Payload gen (XSS/SQLi/SSRF/SSTI/RCE) + bypasses + PoC export |
threat_intel.py |
OTX, Shodan, MISP enrichment; CVE cache; MITRE ATT&CK mapping |
learning_engine.py |
Pattern recognition, technique scoring, insight generation |
self_healing_agent.py |
CPU/mem/disk monitors, auto-recovery, exponential backoff |
agent_router.py |
Intent classification → optimal agent (10+ request types) |
agent_coordinator.py |
DAG orchestration, parallel execution, dependency resolution |
super_agent.py |
Unified chat interface combining all capabilities |
skill_loader.py |
769+ skills, priority routing, semantic search, caching |
https://github.com/muhammad-khalid-bin-walid/Dark-Agent.git
cd "Dark-Agent"
# Install deps
pip install -r requirements.txt
# Configure (copy example, add API keys)
cp configs/config.example.json configs/config.json
# or: cp .env.example .env
# Run
python run.py# Uses configs/docker-compose.yml (Postgres + Redis + Ollama + Dashboard)
docker compose -f configs/docker-compose.yml up -d
# With auto-update sidecar
docker compose -f configs/docker-compose.yml --profile auto-update up -dAccess points:
- Dashboard:
http://localhost:8080 - API:
http://localhost:8000 - Ollama:
http://localhost:11434
pip install -r requirements.txt
python dark_agent.py --target example.com --mode reconDark-Agent/
├── Core Agents
│ ├── agent.py # 94-tool registry + execution
│ ├── brain.py # Multi-LLM orchestration
│ ├── dark_agent.py # Main swarm entrypoint
│ ├── dark_agent_v4.py # Enhanced v4 agent
│ ├── dark_unified.py # Unified single-file build
│ ├── super_agent.py # Interactive chat orchestrator
│ ├── run.py / run_agent.py # CLI entrypoints
│
├── Agent Systems
│ ├── agent_router.py # Intent → agent routing
│ ├── agent_coordinator.py # Multi-agent DAG execution
│ ├── chain_engine.py # Vuln chaining (NetworkX)
│ ├── exploit_developer.py # Payload gen + PoC export
│ ├── threat_intel.py # IOC enrichment + MITRE mapping
│ ├── learning_engine.py # Pattern learning + scoring
│ ├── self_healing_agent.py # Health monitoring + recovery
│ ├── skill_loader.py # 769+ skill index + search
│ ├── vuln_scanner.py # Scanner coordination
│ ├── vulndb.py # Local CVE/Exploit DB
│ ├── validated_vulns.py # Finding verification
│ ├── zero_day_hunter.py # Novel pattern detection
│
├── Memory & Intelligence
│ ├── ai_brain.py # High-level reasoning loop
│ ├── memory_palace.py # Persistent storage (if present)
│ ├── threat_intel.py # Multi-source IOC enrichment
│
├── Specialized Modules
│ ├── bug-bounty-toolkit/ # VRP-focused modules
│ │ ├── toolkit.py / vrptoolkit.py
│ │ └── modules/ (recon, cloud, mobile, AI, Chrome, exploitation)
│ ├── ai-bug-hunter/ # Autonomous hunting swarm
│ │ ├── ultimate_bug_hunter.py
│ │ ├── supreme_bug_hunter.py
│ │ ├── master_launcher.py
│ │ └── brain/ / core/ / battle_testing/
│ ├── dashboard.py # FastAPI + WebSocket UI
│ ├── google_vrp_vulnerabilities.py
│ ├── owasp_audit.py # OWASP Top 10 / API Top 10 checks
│
├── Config & Data
│ ├── configs/
│ │ ├── config.example.json # Template config
│ │ ├── docker-compose.yml # Full stack
│ │ └── *.yaml # Hunt/schedule templates
│ ├── .env.example # Env template
│ ├── requirements.txt / pyproject.toml
│ ├── findings/ # Output vault
│ ├── reports/ # Generated reports
│ ├── examples/ # Usage scripts
│ ├── templates/ # Hunt configs
│ ├── scripts/ # Install helpers
│ ├── tests/ # Pytest suite
│ ├── docs/ # 50+ guides (QUICKSTART, API, SPEC, TOOLS…)
│
└── .agents/skills/ # 769+ cybersecurity skills
├── anthro-cybersecurity/ # 753 skills (recon, pentest, DFIR, cloud, malware…)
└── claude-cyber-security/ # 16 skill areas (recon, vuln scan, exploit dev, RE, malware, threat hunt, IR, net sec, web sec, cloud, CSOC, log analysis, crypto, red team, blue team)
| Guide | Description |
|---|---|
| Quick Start | 5-minute runbook |
| Features | Complete capability matrix |
| API Reference | Python + REST API |
| Technical Spec | Architecture, data flows, extension points |
| Tools Reference | All 94 tools with params |
| Agents | Agent roles, prompts, customization |
| Skills | Loading, authoring, priority routing |
| Configuration | Every config option explained |
| Deployment | Docker, K8s, systemd, cloud |
| Ethics & Scope | Responsible use, scope enforcement |
- Bug Bounty — Automated recon → vuln discovery → chain → validated PoC → report
- Penetration Testing — Full PTES-aligned assessments with evidence
- VAPT — Continuous scanning with learning-driven prioritization
- Red Teaming — Adversary emulation with C2, lateral movement, persistence
- Security Research — Zero-day pattern hunting, variant analysis
- Web3 Audit — Smart contract review (Solidity, Move, Vyper) with fuzzing
Dark Agent is for authorized security testing only.
- Only test assets you own or have explicit written permission for
- Respect
scope.txt/ program policies /robots.txt- Report findings through proper channels (VDP, HackerOne, Bugcrowd, etc.)
- Do not use for unauthorized access, data exfiltration, or disruption
- The authors assume no liability for misuse
See SECURITY.md for vulnerability disclosure and ETHICS_SCOPE.md for scope enforcement details.
We welcome PRs for:
- New tools / skills / agents
- Bug fixes & performance
- Documentation & examples
- Test coverage
Please read CONTRIBUTING.md and CODE_OF_CONDUCT.md.
MIT License — See LICENSE
🔐 Built by security researchers, for security researchers.
Star ⭐ the repo if Dark Agent helps you find impactful bugs.