New & open source · Heading to Black Hat Arsenal 2026
finding 15fab1cd indirect_injection → agent hijack user LLM tool sink USER user input LLM agent core decides tool calls read_file tool call doc.txt poisoned · canary planted tool result web_search tool call · canary in arg SINK data exfil PWN-1877212B ⚠ agent hijack · High CVSS 8.2 ✓ canary observed in web_search arg

AI Security Research

The Runtime Attack Graph Engine
for AI Agents

pip install pwngraph

● pip install pwngraph · full open-source release at Black Hat Arsenal 2026.

AI
Powered
100%
Open Source
0
Cloud Dependency
3.10+
Python Required
1cmd
To Install
6
Attack Classes

AI agents have no runtime tool to trace multi-hop attack chains across tools, retrieval, and memory.

PwnGraph attaches to a live LangChain agent and hooks every tool call as it runs.

A fuzzer fires adversarial inputs; a canary observed inside a real tool argument is the success oracle: proof, not prediction.

Every confirmed path lands in a typed NetworkX graph and an interactive pyvis report.

pwngraph scan --target agent.py:build_agent --attacks all
Read the docs →

$ pwngraph scan --target lab_agent.py:build_agent --attacks all

[Connector] enumerated 4 tools

[Tracer] hooked agent.invoke()

[Fuzzer] 6 attack classes × 50 iter

[GraphBuilder] 9 dangerous paths · 7 findings

[Oracle] ASR 34.4% · Grade D

 

✓ canary observed in tool args

✓ report.html + attack_graph.html

See PwnGraph in action

A full scan against a live AI agent, from one command to the attack graph.

Architecture & data flow

Five core stages, one direction. A canary looping back is the Oracle confirming a real exploit.

PWNGRAPH RUNTIME PIPELINE target enters from the top · left-to-right flow · crimson loop = Oracle's canary proof · hover any stage INPUT Target Agent: any LangChain or LangGraph agent (any tool-using agent via the Connector). Pass file.py:factory at the CLI. PwnGraph treats it as a black box and attaches at runtime. Target Agent LangChain / LangGraph file.py:factory Connector: attaches to the live agent and enumerates its tool registry. No instrumentation of agent source code required. The only framework-specific stage. Connector enumerate tools 1 Fuzzer: generates adversarial payloads across all 6 attack classes, each carrying a unique canary token to confirm the attack reached a real tool call. Fuzzer adversarial inputs + canary 2 Tracer: hooks every tool call, capturing input, output, and state transitions as the agent runs. Produces the full execution trace the Oracle judges. Tracer hook tool calls 3 Oracle: the 5-signal behavioural judge. Confirms a compromise deterministically — most strongly when a unique canary token lands inside a real tool-call argument. Proof, not prediction. Oracle 5-signal proof judge 4 GraphBuilder: converts confirmed compromises into a typed NetworkX attack graph. Nodes: UserInput, ToolCall, ToolResult, DangerousOutcome. Edges: DirectInjection, ContextPoisoning, ToolManipulation, DataExfil. GraphBuilder typed NetworkX + path finder 5 Reporter: an extension of the GraphBuilder. Renders an interactive pyvis attack-graph HTML with path highlighting, plus a severity-ranked HTML report, SARIF, and ASR. Reporter extension · pyvis HTML report · SARIF · ASR OUTPUT canary in a real tool arg Oracle proves the path, not predicts it
PWNGRAPH RUNTIME PIPELINE top-to-bottom data flow · tap a stage for details INPUT Target Agent: any LangChain or LangGraph agent (any tool-using agent via the Connector). Pass file.py:factory at the CLI. PwnGraph treats it as a black box and attaches at runtime. Target Agent LangChain / LangGraph file.py:factory Connector: attaches to the live agent and enumerates its tool registry. No instrumentation of agent source code required. The only framework-specific stage. 1 Connector enumerate tools Fuzzer: generates adversarial payloads across all 6 attack classes, each carrying a unique canary token to confirm the attack reached a real tool call. 2 Fuzzer adversarial inputs + canary Tracer: hooks every tool call, capturing input, output, and state transitions as the agent runs. Produces the full execution trace the Oracle judges. 3 Tracer hook tool calls Oracle: the 5-signal behavioural judge. Confirms a compromise deterministically — most strongly when a unique canary token lands inside a real tool-call argument. Proof, not prediction. 4 Oracle 5-signal proof judge GraphBuilder: converts confirmed compromises into a typed NetworkX attack graph. Nodes: UserInput, ToolCall, ToolResult, DangerousOutcome. Edges: DirectInjection, ContextPoisoning, ToolManipulation, DataExfil. 5 GraphBuilder typed NetworkX + paths Reporter: an extension of the GraphBuilder. Renders an interactive pyvis attack-graph HTML with path highlighting, plus a severity-ranked HTML report, SARIF, and ASR. Reporter extension · pyvis HTML · report · SARIF · ASR OUTPUT canary in a real tool arg Oracle proves the path, not predicts it

How PwnGraph compares

Tools like garak (NVIDIA) and PyRIT (Microsoft) are excellent at what they do: they probe a language model and judge its text output for jailbreaks, leakage, and unsafe responses.

PwnGraph works one layer deeper. It attaches to the live agent, fuzzes it, and judges the agent's tool-call actions, proving when an injection becomes a real command, file read, or data exfiltration, and tracing the full multi-hop chain as an attack graph.

garak and PyRIT test what the model says. PwnGraph tests what the agent does.

Dimension garak NVIDIA PyRIT Microsoft PwnGraph
What it targetsLLM model / endpointGenAI systems, orchestratedLive agent + its tools
What it judgesModel text outputModel responses (scored)Tool-call arguments & actions
Core question"Will it say something bad?""Can we elicit risky behavior?""Does it cause a harmful action?"
Multi-hop tool chainsNot the primary focusMulti-turn supportedTraced as an attack graph
Proof of impactOutput matches a detectorClassifier scoreCanary observed in a real tool call
Visual outputReports / logsLogs / scoresInteractive pyvis graph

One engine, every agent framework

Attach PwnGraph to the stack you already run. Live today, with the most popular frameworks landing next.

Supported now
LangChain LangGraph
Next up
AutoGen CrewAI
On the roadmap
OpenAI Agents SDK LlamaIndex Semantic Kernel

Want your framework prioritized? Open a GitHub issue.

Trace attack paths in your own agent today

MIT licensed. Runs entirely on your machine.
pip install pwngraph

GitHub Read the docs →