README.md

What is HackAgent?

HackAgent is a comprehensive Python SDK and CLI designed to help security researchers, developers, and AI safety practitioners evaluate and strengthen the security of AI agents.

As AI agents become more powerful and autonomous, they face security challenges that traditional testing tools cannot address:

Threat	Description
Prompt Injection	Malicious inputs that hijack agent behavior
Jailbreaking	Bypassing safety guardrails and content filters
Goal Hijacking	Manipulating agents to pursue unintended objectives
Tool Misuse	Exploiting agent capabilities for unauthorized actions

HackAgent automates testing for these vulnerabilities using research-backed attack techniques, helping you identify and fix security issues before they are exploited.

Get Started Now

Quick Install

python3 -m venv .venv
source .venv/bin/activate
pip install hackagent

No API key required: HackAgent works locally out of the box.

Standalone binary (no Python required)

Every GitHub Release ships a self-contained archive per platform:

Platform	Asset
Linux x86_64	hackagent-<version>-linux-x86_64.tar.gz
macOS arm64	hackagent-<version>-macos-arm64.tar.gz
macOS x86_64	hackagent-<version>-macos-x86_64.tar.gz
Windows x86_64	hackagent-<version>-windows-x86_64.zip

Extract the archive and run the hackagent launcher inside it — no Python, pip or uv install needed. Keep the extracted folder intact; the launcher loads the libraries next to it.

Note: the WEB provider drives a real browser through Playwright, whose browser binaries cannot be embedded in the archive (or in the PyPI package). Before using hackagent web-based targets, install them once with playwright install.

Questions? Join community discussions or email ais@ai4i.it.

Architecture

HackAgent uses a modular pipeline to test agent robustness end-to-end.

Component	Description
Attack Engine	Orchestrates attacks using AdvPrefix, AutoDAN-Turbo, PAIR, TAP, FlipAttack, BoN, h4rm3l, CipherChat, PAP, and Static Template
Generator	LLM role that creates adversarial prompts to test the target agent
Judge	LLM role that evaluates whether attacks bypass safety measures
Target Agent	Your AI agent under test across supported frameworks
Datasets	Pre-built benchmark presets plus custom HuggingFace/file/URL JSON datasets

Supported Frameworks

Reporting

HackAgent supports both local and remote reporting.

• Local mode stores test results in SQLite and includes a built-in dashboard.
• Cloud mode syncs runs to the HackAgent remote platform when an API key is configured.

hackagent web

Access cloud reporting at https://app.hackagent.dev.

Responsible Use

HackAgent is designed for authorized security testing only. Always obtain explicit permission before testing any AI system.

Do

• Test your own agents
• Conduct authorized pentesting
• Follow coordinated disclosure
• Share security knowledge responsibly

Don't

• Test systems without permission
• Exploit vulnerabilities maliciously
• Violate terms of service
• Share harmful exploit instructions irresponsibly

Read the full guidelines: Responsible Disclosure

Contributing

Contributions are welcome. See CONTRIBUTING.md and CODE_OF_CONDUCT.md.

License

Licensed under Apache-2.0. See LICENSE.

Disclaimer

HackAgent is intended for security research and AI safety improvement. The authors are not responsible for misuse.