Keygraph

Creators of Shannon (

[Keygraph @KeygraphHQ]

We ran our open-source pentester against the same app Doyensec used to compare Aikido and XBOW.

$6.10 run: found the critical pre-auth SQLi.
$115 run: found 6 of the 7 vulns later patched.

Aikido and XBOW: $4,000 per scan.

Shannon 3.0 is live. 🧵

[Keygraph @KeygraphHQ]

6/ So if you already subscribe to Grok:

You may already have most of what you need for an on-demand AI pentester.

Shannon is open source:
https://t.co/f5ucUwBq6b

Grok + Shannon is a pretty powerful combination.

[Keygraph @KeygraphHQ]

1/ Your @xai Grok subscription is now basically an on-demand AI hacker.

Pair it with Shannon and you can pentest your applications whenever you want, using the subscription you already pay for.

No separate API bill. No extra token spend.

And it works surprisingly well.

[Keygraph @KeygraphHQ]

5/ Grok has become one of the easiest ways to get Shannon running quickly.

Its guardrails are generally compatible with legitimate pentesting workflows, and you can get started without going through an additional lengthy approval process.

Install Shannon.
Connect Grok.
Point it at your app.

Go.

[Keygraph @KeygraphHQ]

A year ago today, we pushed the first commit of Shannon to a public GitHub repo and now Shannon has 48.5k stars!

Here's what the year looked like:
• 27 releases, from v1.0 in March to v3.3 last month
• 145 merged pull requests and 148 closed issues
• Shannon 2.0 (July): rebuilt from the ground up to run on the model you already use, including Anthropic, OpenAI, xAI, Bedrock, and local models
• Shannon 3.0 (September): reads your code before it attacks, maps trust boundaries and data flows, runs inside your CI/CD pipeline, and delivers PDF and SARIF reports

Thank you to everyone who tried out Shannon for themselves! Every bug report and every Discord question made the next release better. And thank you to the Keygraph team for 27 releases in six months!

Happy Birthday Shannon!

[Keygraph @KeygraphHQ]

@gergomoricz You should definitely give Shannon a shot if you have a chance :) https://t.co/f5ucUwBq6b

[Keygraph @KeygraphHQ]

Shannon 3.0 brings automated pentesting straight into your CI/CD pipeline via our official GitHub Action and GitLab component.

How it works:
Automated Testing: Checks out your source code and attacks your running staging target.

Rich Reporting: Exports PDF, Markdown, and SARIF artifacts, feeding SARIF data directly into GitHub Code Scanning.

Strict Validation: Jobs only pass if every vulnerability class is assessed. Setting fail-on-severity blocks the build only when Shannon successfully proves an exploit.

Flexible Triggers: Out of the box, run it per PR, on release, or on a weekly schedule.

With Shannon, Keygraph is trying to shift the entire pentesting process left, turning what has traditionally been a once-a-year engagement into a routine developers can run as often as they like.

This however can only work if the runs are affordable. Ours cost $6.10 in DeepSeek v4 Flash tokens against Photoview 2.4.0, the benchmark app Doyensec used to compare two $4,000 platforms, and it flagged the exact same critical SQL injection: a pre-auth boolean oracle, CVSS 9.8, unauthenticated read of the whole database.

GitHub Action: https://t.co/TWnjSFv0Nr

Benchmark: https://t.co/HNhggasRrc

[Keygraph @KeygraphHQ]

Shannon remains open source, self-hosted, and model-agnostic. Run it on-prem or in your cloud, in CI, with whatever model provider you want.

Goal: make continuous pentesting a normal part of how software gets built.

Full announcement: https://t.co/zFocfxpW6B

[Keygraph @KeygraphHQ]

We ran our open-source pentester against the same app Doyensec used to compare Aikido and XBOW.

$6.10 run: found the critical pre-auth SQLi.
$115 run: found 6 of the 7 vulns later patched.

Aikido and XBOW: $4,000 per scan.

Shannon 3.0 is live. 🧵

[Keygraph @KeygraphHQ]

Benchmark details: Photoview 2.4.0, three BYO models — DeepSeek v4 Flash, Grok 4.6, Claude Opus 5.

All three found the critical SQLi. Costs ran $6.10 to $115.

Full methodology, reports, costs, misses, and limitations:
https://t.co/dgRh3SELbK

[Keygraph @KeygraphHQ]

@MAXdeg0 Thanks so much for covering us!
We have a huge launch (v3.0) coming out on Wednesday!

[Keygraph @KeygraphHQ]

9/
Thank you to everyone who tested Shannon, filed issues, shared feedback, and pushed the project further than we ever expected.

Announcement: https://t.co/B0Zq1wd0ts

Repo: https://t.co/f5ucUwBq6b

[Keygraph @KeygraphHQ]

1/
Today we're officially launching Shannon 2.0.

Six months, 46K GitHub stars, and hundreds of thousands of pentest runs later, we rebuilt almost the entire engine. It now runs any major model, on a fully open-source harness. 🧵

[Keygraph @KeygraphHQ]

8/
Upgrading from 1.x: rerun the setup wizard before your first 2.0 scan.

The three model tier variables are gone, and Google Vertex AI support has been removed. Full migration steps are in the announcement.