Claude Code pentest-ai-agents v3.4.0 released
By SecBurg
pentest-ai-agents turns Claude Code into an offensive security research assistant with specialized subagents for authorized penetration testing engagements.
In short: it’s a collection of 50+ Claude Code subagents covering the full pentest lifecycle, from recon and OSINT to exploitation, post-exploitation and reporting.
v3.4.0 adds two new agents and grows the collection from 50 to 52 tools.
The fix-verifier agent closes a gap in remediation validation: while poc-validator confirms a bug exists, fix-verifier tests whether a claimed fix actually works. It replays the original proof-of-concept instead of a weaker substitute, tests the whole vulnerability class rather than one exact payload string, checks sibling endpoints and older API versions, and verifies that legitimate features still work. Verdicts come back as CLOSED, PARTIAL, NOT FIXED, REGRESSED, or BROKEN BY FIX, backed by a pattern table of common failed remediation approaches.
The supply-chain-auditor agent looks at build dependencies rather than just authored code: SBOM inventory across transitive dependencies, dependency-confusion risk weighted on resolution configuration, typosquatting detection, install-time hook analysis, lockfile and provenance verification, and maintainer risk assessment. Findings are prioritized by blast radius rather than raw CVSS severity, since a low-severity issue in a CI or deploy-credential package can matter more than a critical one in a sandboxed leaf dependency.
Both new agents ship with mandatory scope-guard protections and refuse to run against undeclared targets.
Full release notes are available on the releases page.
Happy pentesting! :-)