Security researchers Harel Rom and Gabriel Balko released open kritt, an open source platform that orchestrates AI agents to find vulnerabilities in code, according to the project's GitHub repository. The tool breaks security analysis into focused tasks that run in parallel, then combines the results into de-duplicated, ranked findings.
Tool-enabled agents run in disposable containers with repository access and internet connectivity, letting them install dependencies and build working proof of concept exploits rather than only flagging suspicious code. The platform supports multiple model providers, including Claude, OpenAI, OpenRouter and xAI, and lets researchers build reusable scanning workflows the project calls playbooks.
The creators say they have earned more than $1.5 million in bug bounties under the researcher handle Blockian, positioning open kritt as a release of their own internal process rather than a new product built from scratch. It is licensed under the AGPL 3.0 and had drawn roughly 2,000 GitHub stars.
The project's own documentation warns that agents run with elevated privileges inside their containers and tells users to review the threat model before pointing the tool at code they do not trust, a reminder that a tool built to find dangerous vulnerabilities is itself worth handling carefully.
For security teams, a tool like this cuts both ways: it lowers the cost of finding real bugs in your own dependencies before an attacker does, and it lowers the cost of finding them in someone else's software first. Which side of that trade dominates will depend entirely on who ends up running it most.