AI-Driven Cybersecurity Agent for Pentesting and Red Teaming
Cyber-harness is an agent runtime designed for cybersecurity testing, combining model reasoning, tool execution, knowledge integration, and collaborative capabilities into a unified extension-based framework. Developed by ChainReactors and released in 2026, it operates as a single binary solution for penetration testing, red teaming, and bug bounty activities. The project is licensed under AGPL 3.0, ensuring open-source compliance with copyleft provisions.
The core architecture of Cyber-harness revolves around an extension lifecycle that consolidates all functionalities—from model-driven reasoning to tool execution—into a cohesive system. This modular design allows users to either deploy the reference distribution or customize their own Go-based application by assembling the required capabilities. The framework supports two primary distributions: aiscan and aiscan-full. The former includes the agent, core scanners, proxy routing, skills, and IOA (Internet of Agents) collaboration, while the latter extends these features with a Web workbench, browser automation, passive reconnaissance, and deep crawling capabilities.
The project emphasizes deterministic and interactive scanning, allowing users to run tasks locally or against authorized targets. For example, a user can execute a local task with the command aiscan agent -p "Read the current directory and explain its structure; do not modify files" -o first-run.jsonl, or perform a deterministic scan without AI verification using aiscan scan -i http://127.0.0.1:3000 --verify=off.
The agent’s design allows the model to dynamically select tool calls, while the scan pipeline operates through configurable rules and scan events, with optional AI-driven stages. Both mechanisms rely on the same underlying tool infrastructure, ensuring consistency and flexibility. Configuration is managed via a cyber.yaml file, which can be initialized using the aiscan init command. This file supports project-specific overrides and integrates with various large language models (LLMs), including OpenAI, Anthropic, and DeepSeek. Users configure their preferred LLM provider, base URL, and model within this file, with credentials managed via environment variables such as OPENAIAPIKEY.
Documentation for Cyber-harness is maintained in both English and Chinese, covering installation, usage, and development. The Concepts section introduces the harness, models, tools, sessions, and knowledge without requiring prior Go experience. The User Guide progresses from basic installation to advanced topics like sessions, tools, scanning, and collaboration. For developers, the Developer Guide outlines the process of building a Go application, starting with a runnable tool and progressing to embedded sessions, extensions, and host integration. The Architecture section details the composition and lifecycle of the agent loop, execution context, and data flow, while configuration and API specifics are documented in the reference materials.
Users can clone the repository, navigate to the project directory, and build the standard or full distribution using make commands. For offline tool extraction, the ARSENALEMBED=1 flag can be used during the build process. The Arsenal maintains tool definitions and default versions in arsenal.yaml, with each distribution selecting tools via bundle.yaml. Custom distributions can be created by calling harness.BaseExtensions(config), appending extensions, and passing them to extension.New. The host manages the Load and Close operations, with the reference distribution assembled in cmd/aiscan. Embedders can use pkg/harness for a generic host or compose their own extensions.
This standalone distribution supports model-assisted audits of source code, business logic, and binary files, with features such as interactive sessions, one-shot audits, and evidence reports. Tools like rg, ast-grep, and osv-scanner are embedded in the audit distribution, while reverse engineering tools are available via Arsenal installation.
Key architectural changes in 1.0.0-rc6 include the separation of scanner-specific modules, improved configuration precedence, and the removal of deprecated features such as severity thresholds and auto-execution modes. Configuration discovery prioritizes project-specific cyber.yaml files, ensuring consistency and reducing ambiguity.
Cyber-harness integrates with the Internet of Agents (IOA) framework, enabling collaboration between agents through a shared protocol. The proxyclient module provides multi-protocol proxy capabilities, while the crtm package serves as a security tool registry. Additional utilities include shared libraries for PTY management, protocol parsers, and other foundational components. The project’s modular design allows for seamless integration with existing security workflows, making it a versatile tool for both offensive security testing and research.
The disclaimer for Cyber-harness emphasizes its authorized use for security testing and research. Users are required to set up their own lab environments for testing and ensure compliance with local laws and regulations. Unauthorized scanning is strictly prohibited, and users assume full legal responsibility for any illegal activities conducted with the tool. The license, AGPL 3.0, ensures that any modifications or extensions to the project remain open-source, reinforcing the community-driven development model.
Use Cases for Cyber-harness
Cyber-harness is primarily designed for penetration testers, red teams, and bug bounty hunters who require an AI-driven, extensible framework for security assessments. Its modular architecture allows for tailored deployments, whether for automated scanning, interactive audits, or collaborative red teaming exercises. The tool’s ability to integrate with various LLMs and security tools makes it adaptable to different testing scenarios, from source code audits to network reconnaissance.
Users can configure the agent to perform scans with or without AI verification, depending on the requirements of the engagement. For example, a red team might use the aiscan scan command to conduct a deterministic scan of a target system, while an auditor could leverage the cyber-audit distribution for model-assisted source code analysis.
The integration of browser automation and passive reconnaissance capabilities in aiscan-full extends its applicability to web-based security assessments. Testers can simulate user interactions, automate workflows, and perform deep crawling to identify vulnerabilities in web applications. These features make Cyber-harness a comprehensive solution for modern web security testing.
The Go-based architecture allows for the creation of bespoke security tools by assembling the necessary extensions. Developers can embed the agent within larger applications, integrate custom tools, or extend existing functionalities through the extension lifecycle. The project’s documentation provides detailed guidance on building tools, managing sessions, and integrating with the IOA framework, facilitating innovation within the security community.
Key Features and Capabilities
Cyber-harness distinguishes itself through its extension-based architecture, which unifies model reasoning, tool execution, and collaboration into a single framework. This design enables users to assemble custom distributions tailored to specific security testing needs. The reference distributions, aiscan and aiscan-full, provide preconfigured sets of capabilities, while the cyber-audit module offers specialized functionality for source code and binary audits.
The agent’s core capabilities include dynamic tool selection, configurable scan pipelines, and support for multiple LLMs. Users can configure their preferred model provider and settings via the cyber.yaml file, ensuring compatibility with services like OpenAI, Anthropic, and DeepSeek. The Web workbench in aiscan-full enhances usability with features like session management, goal tracking, and interactive result visualization.
Cyber-harness supports a wide range of security tools and protocols through its Arsenal system. Tools such as rg, ast-grep, and osv-scanner are embedded in the audit distribution, while additional tools can be installed via Arsenal.
Users can build custom distributions by extending the base harness or composing their own sets of extensions.
The disclaimer underscores the importance of authorized use and compliance with local regulations, while the AGPL 3.0 license ensures that any modifications to the project remain open-source.
Technical Implementation and Development
The project’s release notes highlight significant changes in recent versions, such as the consolidation of build processes and the simplification of distribution editions.
The build process for Cyber-harness is standardized through the use of Makefile and editions.env, which define the compilation rules and CGO strategies for different editions. The standard and full distributions now share a unified Go compilation pipeline, with optional dependencies like CGO and native recording SDKs managed explicitly. This approach ensures consistency across platforms and reduces complexity in the build process.
Cyber-harness’s runtime capabilities are organized around a single extension lifecycle and static profile combinations. Custom distributions can start with minimal capabilities provided by pkg/base.New or reuse official product combinations via pkg/aiscan.New. The separation of Web, PTY, process, prompt, scanner, and IOA client capabilities into distinct extensions ensures clarity and modularity in the architecture.
The Web interface provides a centralized hub for managing sessions, tracking goals, and visualizing results, while the CLI offers machine-readable outputs and consistent parameter handling. These features enhance the tool’s usability and adaptability, making it suitable for a wide range of security testing scenarios.
Cyber-harness’s documentation and development guides provide comprehensive resources for users and contributors. The Concepts section introduces the harness’s core components, while the User Guide covers installation, configuration, and advanced usage. The Developer Guide outlines the process of building custom tools and integrating extensions, with examples ranging from simple commands to embedded sessions. The Architecture section details the agent loop, execution context, and data flow, offering insights into the project’s design principles and technical implementation.