Inspiration
I teach Software Security Testing at a vocational school and I've spent 13+ years in test automation. Every term I watch the same thing happen: students — and plenty of working developers — know the OWASP Top 10 as a list of names, but freeze when asked to actually find one of these flaws in a running app. Security testing is still treated as a specialist ritual, something you schedule once a year and pay a consultant for. I wanted to see whether an agent could close that gap: not a scanner that blindly fires payloads, but something that reasons about a target the way a careful tester does, runs the tests, and explains each finding with current, cited evidence.
What it does
Sentinel is an autonomous application-security testing agent. You point it at a running web app and it:
- Recons the target — crawls pages, discovers forms, endpoints and auth flows.
- Plans — reasons about which OWASP Top 10 categories actually apply to this target and writes a concrete, structured test plan.
- Executes — sends real crafted requests (SQL injection, XSS, broken authentication, IDOR / broken access control) and captures the actual request/response as evidence.
- Triages — classifies each result as confirmed / likely / false-positive, assigns a CWE and severity, and discards the noise.
- Enriches — for every confirmed finding it pulls live CVE advisories and remediation guidance, so the fix advice is current and sourced, not invented.
- Reports — a clean dashboard with severity breakdown, evidence, and cited remediation for each finding.
The whole pipeline runs live in the UI so you can watch the agent think and test.
How we built it
- Reasoning & triage — NVIDIA Nemotron on Nebius Token Factory. The planning step, where the agent decides which attacks make sense for the target, runs on Nemotron-Super-120b for serious reasoning. The high-volume triage step — scoring and filtering every raw result — runs on the smaller, faster Nemotron-Nano-30b to keep latency and credit usage low. Token Factory's OpenAI-compatible API let us drive both with a single SDK.
- Live threat intelligence — Tavily. Each confirmed finding triggers a Tavily search for current CVEs, advisories and remediation, which we attach to the report as dated, linked sources. This is what stops the remediation advice from being a stale hallucination.
- Execution engine. Python + FastAPI backend, httpx for the actual attack traffic, with a hard host-allowlist guard so the agent can only ever test the target you authorize. React dashboard on top, streaming agent progress over SSE.
- Target. We demo against OWASP Juice Shop, the industry-standard deliberately vulnerable app, but any URL can be scanned.
Challenges we ran into
Getting the Nemotron reasoning models to return clean, parseable JSON was the main challenge: the reasoning-tier model often puts its answer in a separate reasoning field and leaves the content field empty, so our first parser wrongly concluded the model was unavailable and fell back to heuristics. We fixed this by reading the reasoning field when content is empty and extracting the JSON block from it. The second challenge was recon depth — OWASP Juice Shop is an Angular SPA, so crawling the root page finds no input parameters; we added a known-endpoint seed (login, product search, basket items) so the agent discovers real injection points instead of only testing headers. Finally, keeping the agent safe meant a strict host-allowlist that fails closed, so it can never send attack traffic to anything but the authorized target.
Accomplishments that we're proud of
In a full scan of OWASP Juice Shop, Sentinel confirmed 5 vulnerabilities across 4 OWASP Top 10 categories — SQL injection (authentication bypass and error-based), broken authentication, and IDOR / broken access control — in under 100 seconds, each with real request/response evidence and live Tavily-sourced remediation. Crucially, it correctly dismissed a reflected-XSS probe as a false positive, because Juice Shop's XSS is DOM-based with no server-side reflection to confirm over HTTP. That restraint is the point: the triage reasoning filters noise instead of inflating the finding count, which is what makes an autonomous scanner trustworthy.
What we learned
Open models have come a long way for structured, agentic reasoning: Nemotron-Super-120b produced genuinely context-aware test plans rather than firing a fixed payload list. Splitting the work — a large model for planning, a small fast one for high-volume triage — kept both quality and cost in a good place on Token Factory. And pairing the model with live retrieval (Tavily) turned out to matter a lot for security tooling specifically, because remediation advice has to reflect current CVEs and advisories, not a model's stale training data.
What's next for Sentinel
Broaden OWASP coverage (SSRF, injection variants, security misconfiguration), authenticated multi-role scanning for deeper access-control testing, CI/CD integration so every pull request gets an agentic security pass, and exportable reports for compliance. The longer-term goal is a teaching mode: an agent that walks a student through why each vulnerability exists and how the exploit works.
Log in or sign up for Devpost to join the conversation.