Show HN: Khaos – Every AI agent I tested broke in under 30 seconds
1 comments
> The repo includes 6 intentionally vulnerable example agents
I don't understand the title. Every agent in the wild is insecure or only the agent in your repo are insecure?
I don't understand the title. Every agent in the wild is insecure or only the agent in your repo are insecure?
The repo includes 6 intentionally vulnerable example agents (support bot, SQL agent, code executor, payment processor, API agent, document processor) with real attack scenarios showing exactly how they break. Try breaking them yourself.
Three commands to test your own agent:
- pip install khaos-agent - khaos discover - khaos run my-agent --pack security
It works with raw OpenAI/Anthropic, Gemini, LangGraph, CrewAI, AutoGen — any Python agent. Khaos auto-patches LLM calls to inject faults and log telemetry. No cloud needed, runs 100% locally.
Some of what it tests:
- Prompt injection (policy bypass, developer mode exploits) - Tool misuse (unauthorized DB writes, unscoped API calls) - Data exfiltration (PII extraction, credential leakage) - Fault injection (timeouts, rate limits, malformed tool responses)
We are the first platform that focuses on testing the Agent's environment, not just the model in the harness.
Plus 4 tutorials using the free Gemini API if you want to learn without spending anything. Repo: https://github.com/ExordexLabs/khaos-sdk Examples: https://github.com/ExordexLabs/khaos-examples BSD licensed. v1.0 just shipped — the attack library and framework adapters are growing. What agents are you most worried about breaking?