OpenHack
A free, open-source, experimental framework from security firm Hadrian that turns a coding AI assistant like Claude Code or Cursor into a structured vulnerability-research team — complete with checkpointed progress and OWASP/MITRE-aligned expert agents.
🔗 Visit OpenHack
Description
Manually reviewing a large codebase for security vulnerabilities is slow, expensive expert work — and pointing an AI coding assistant at the same task without structure tends to produce shallow, unreliable results. OpenHack sits in between: it packages the way professional security researchers actually work — recon, scoped hypotheses, triage, verification — into a workflow a coding AI can follow step by step, like giving the AI a case file and a procedure instead of just asking it to 'find bugs.'
OpenHack is a free, open-source (MIT) research prototype from the Dutch security firm Hadrian, built as a lightweight, file-based workspace that runs inside a coding harness such as Claude Code or Cursor. It keeps all state in plain files — cloned source, recon items, scenario prompts, results, finding candidates, triage decisions — so every step of a review is durable and auditable. It includes 12 OWASP/MITRE-aligned expert agents, a scenario-router for scoped testing, independent finding triage for severity assessment, and human-in-the-loop approval gates before anything is reported as a real finding.
💬 Our review
The short version: if you already use Claude Code or Cursor and want to point it at a codebase for structured security review rather than an unguided 'find the bugs' prompt, OpenHack is a free, methodical framework built by an actual security research firm to do exactly that.
Compared to just prompting a coding assistant directly, OpenHack's structure — recon, scoped scenarios, independent triage, human approval gates — is the core value: it constrains the AI to a defensible research methodology instead of free-associating, which Hadrian's own team used to find real vulnerabilities (including a critical one) in open-source software used by government agencies. Against a traditional deterministic scanner, OpenHack is complementary rather than competing — it's aimed at deeper, source-guided whitebox review, not broad automated surface scanning.
The honest limits: it's explicitly labeled an experimental research prototype (version 0.1.0), not a polished production tool, so expect rough edges and evolving APIs. It also requires an underlying coding harness and LLM access, so there's a real API cost on top of OpenHack itself being free, and results still need a human security reviewer to validate before acting on any finding. For a security team already using AI coding agents that wants a more rigorous, checkpointed way to run whitebox vulnerability research, it's worth trying for free; for a turnkey scanning tool with no assembly required, a mature product like OWASP ZAP or a commercial scanner is more plug-and-play.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Open source (licence MIT), gratuit. Prototype de recherche expérimental — nécessite un harnais de code IA (Claude Code, Cursor...) et un accès LLM facturé séparément.
Pros
Méthodologie structurée (recon, scénarios ciblés, triage indépendant) plutôt qu'un prompt IA non guidé
12 agents experts alignés OWASP/MITRE
État durable en fichiers plats — chaque étape est traçable et auditable
Portes de validation humaine avant qu'une trouvaille soit considérée réelle
Cons
Prototype de recherche expérimental (v0.1.0), pas un outil de production stable
Nécessite un harnais de code IA + accès LLM payant séparément
Les résultats doivent toujours être validés par un humain avant action