Beyond ARTEX: 45 Agentic Attack Frameworks, What They Hunt For, and How to Find Them

A GitGuardian survey identifies roughly 45 open-source agentic penetration-testing frameworks that connect language models to tool-execution loops, organizing 32 into network kill-chain, web/API, C2-integrated, harness, and research-prototype families while treating the remainder as forks or variants. The analysis finds that only Pojun, Cybermes, Xalgorix, and AIRecon provide secret scanners directly reachable by their agents, and none includes a built-in GitHub fetcher, although widespread shell and web access could allow models to assemble secret-hunting workflows at runtime. Risk is concentrated in widely forked projects such as the removed ARTEX platform, whose takedown was followed by numerous copies and derivatives, rather than in the highest-starred repositories. Shodan fingerprinting of 41 frameworks found 11 with web interfaces enabled by default and numerous publicly reachable consoles, including 1,428 ARTEX-family services, 419 PentAGI services, and 173 Agent Zero instances as of November 7, 2026; some exposed systems lacked meaningful protection. The catalog provides code locations, activity indicators, secret-hunting capability grades, exposure classifications, and Shodan fingerprints to help defenders identify and secure their own deployments.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.