What is attacksaga?

AttackSaga is an AI agent that automatically finds and exploits security weaknesses in a deliberately vulnerable test application called OWASP Juice Shop, which is a free tool built specifically for practicing security testing in a safe, legal way. The agent uses a large language model to reason about each step, decide what to try next, run the action, look at the result, and repeat, working through a chain of attack steps on its own rather than requiring a human to guide every move. Safety is built in from the ground up. The tool is hard-locked to only attack targets on your own computer, localhost, and every outgoing request is checked against an allow list before it is sent. If it ever tries to reach anything outside that boundary, the run stops immediately with an error. The README is explicit that using this against any system you do not own or have written permission to test is against the law. The attack process runs through four stages: first logging in without valid credentials by exploiting a flaw in the login form, then finding a part of the application that reveals other users' data through predictable web addresses, then actually pulling another user's private information using that flaw, and finally presenting the extracted data as clear proof that the weakness is real and exploitable. To try it, you first run the Juice Shop test application locally using Docker, then install AttackSaga with Python and add an API key for the language model it uses. You can run the whole chain, just one stage at a time, or use a fully offline demo mode that replays saved responses instead of making real requests or needing an API key at all. There is also an optional local web dashboard that shows the plan, execute, and observe steps happening live, with any sensitive information like emails or tokens hidden by default until you choose to reveal it. The project describes itself as a hackathon-built but fully runnable prototype, with the offline demo mode letting anyone explore how the whole system works without needing real credentials or a live target.