Penetration Monkey

Frontend
Frontend 2
Frontend 3

Inspiration

NIST's CAISI evaluations found that attacks tailored to an AI agent raised hijacking success from 11% to 81%, and that repeating each attack 25 times pushed average success from 57% to 80%. One test run makes an agent, or a website, look safe when it isn't. Our teammate Frank Yu had just written a methodology for agent-level penetration testing built on OWASP ASI, MITRE ATLAS and the EU AI Act. We wanted to turn that paper into something you can actually run against a live target.

What it does

Penetration Monkey is an autonomous web-security scanner. You give it a URL, and it:

renders the page through a real cloud browser and runs deterministic security checks (HTTPS, HSTS, Content-Security-Policy, clickjacking defense, cookie flags, insecure forms), each scored pass / warn / fail with an OWASP reference;
runs an active indirect-prompt-injection probe inside a disposable sandbox with an egress allowlist, then destroys it;
emits every step as a trace span, so each finding links back to the exact action that caused it;
reads an executive briefing of the findings aloud.

How we built it

Frontend: TanStack Start (React 19, Vite 8), Tailwind, shadcn/ui, and a Three.js holographic swarm view. TypeScript throughout, on Bun, hosted on Lovable.
Server: TanStack server functions, so every API key stays server-side. We call sponsor APIs directly over HTTPS, no heavy SDKs.
Anchor Browser opens a real cloud browser session and renders the target we scan.
Daytona gives each probe a disposable sandbox we create, run and destroy.
Arize receives real OpenInference spans over OTLP as the evidence trail.
ElevenLabs turns the briefing into voice.

Challenges we ran into

Keeping the attack contained: every objective points at a planted canary, never a real system, with an egress allowlist, so a "successful" exploit proves the point without causing harm.
Making the judge trustworthy: deterministic checks decide success first (did the canary fire), with a model only for novelty and severity.
Coordinating four people and two AI coding agents on one repo under a hard deadline.

What we learned

The honest version of an agentic demo is harder, and better, than the flashy one. A real browser, a real sandbox and a real trace beat a scripted animation every time, and the judges can tell.

What's next

Replace the shell-script probe with a live LLM agent that genuinely gets hijacked, wire findings into SurrealDB Agent Memory so a re-scan supersedes old results, and expand from one attack class to the full OWASP ASI set.