hackagent 0.15.0

What is HackAgent?

HackAgent is a comprehensive Python SDK and CLI designed to help security researchers, developers, and AI safety practitioners evaluate and strengthen the security of AI agents.

As AI agents become more powerful and autonomous, they face security challenges that traditional testing tools cannot address:

HackAgent automates testing for these vulnerabilities using research-backed attack techniques, helping you identify and fix security issues before they are exploited.

Interactive TUI with real-time attack progress and visual reporting.

Get Started Now

Quick Install

python3 -m venv .venv
source .venv/bin/activate
pip install hackagent

No API key required: HackAgent works locally out of the box. The base install imports without the interface and technique extras:

pip install 'hackagent[tui]'      # textual
pip install 'hackagent[web]'      # flask and the dashboard bundle
pip install 'hackagent[browser]'  # playwright
pip install 'hackagent[rag]'      # faiss and numpy
pip install 'hackagent[vision]'   # Pillow
pip install 'hackagent[hf]'       # HuggingFace datasets

Standalone binary (no Python required)

Every GitHub Release ships a self-contained archive per platform:

Extract the archive and run the hackagent launcher inside it — no Python, pip or uv install needed. Keep the extracted folder intact; the launcher loads the libraries next to it.

Note: the WEB provider drives a real browser through Playwright (pip install 'hackagent[browser]'). The browser binaries cannot be embedded in the archive (or in the PyPI package). Before using hackagent web-based targets, install them once with playwright install.

Questions? Join community discussions or email ais@ai4i.it.

Architecture

HackAgent uses a modular pipeline to test agent robustness end-to-end.

Supported Frameworks

Reporting

HackAgent supports both local and remote reporting.

• A campaign records its results in local SQLite, readable offline.
• Set execution.storage.backend: remote (with base_url and api_key_env) to send a run to a HackAgent server instead.

hackagent web serves the HackAgent dashboard — the same app as app.hackagent.dev — from your own machine, against your cloud data when an API key is configured and against the local SQLite database (read-only) when it is not. Your API key stays in the CLI process and is never exposed to the browser.

hackagent web

Install it with pip install 'hackagent[web]'; see the web command docs for modes and options.

Responsible Use

HackAgent is designed for authorized security testing only. Always obtain explicit permission before testing any AI system.

Do

• Test your own agents
• Conduct authorized pentesting
• Follow coordinated disclosure
• Share security knowledge responsibly

Don't

• Test systems without permission
• Exploit vulnerabilities maliciously
• Violate terms of service
• Share harmful exploit instructions irresponsibly

Read the full guidelines: Responsible Disclosure

Contributing

Contributions are welcome. See CONTRIBUTING.md and CODE_OF_CONDUCT.md.

License

Licensed under Apache-2.0. See LICENSE.

Disclaimer

HackAgent is intended for security research and AI safety improvement. The authors are not responsible for misuse.