Noureddine RAMDI / OpenAnt: An LLM-powered two-stage vulnerability discovery tool with exploit validation

Created Sat, 23 May 2026 20:41:14 +0000 Modified Sat, 23 May 2026 20:41:27 +0000
1045 Words
github-stars security vulnerability-scanning llm python go opensource

knostic/OpenAnt

OpenAnt addresses a persistent problem in vulnerability scanning: too many false positives that waste time and effort. It applies a two-stage pipeline where an AI-driven static analysis flags potential vulnerabilities, then an active exploitation phase attempts to confirm each finding. Only vulnerabilities that survive both stages are reported, a practical approach to improve signal-to-noise ratio in automated security assessments.

What OpenAnt does and its architecture

OpenAnt is an open source tool built to discover vulnerabilities in codebases using large language models (LLMs). It targets multiple popular languages including Go, Python, JavaScript/TypeScript, C/C++, PHP, and Ruby, making it broadly applicable across many projects.

At its core, OpenAnt uses a two-phase analysis pipeline:

  1. Static analysis stage: Leveraging an LLM (Claude Opus 4.6 from Anthropic), the tool performs AI-driven static analysis on source code to flag potential security issues. This stage parses, enhances, and analyzes code to identify suspicious patterns that could become vulnerabilities.

  2. Exploitation stage: Each flagged potential vulnerability is then actively tested in an exploit attempt. This dynamic phase tries to exploit the candidate issue to verify if it’s truly exploitable.

Only findings that survive both detection and exploitation stages are considered real vulnerabilities and reported back. This design drastically reduces false positives by filtering out issues that are theoretically risky but practically safe.

Under the hood, OpenAnt is orchestrated by a Go CLI binary. The CLI manages the workflow and invokes Python 3.11+ runtime components responsible for parsing, AI analysis, enhancement, and reporting. This polyglot architecture leverages Go’s performance and ease of deployment for CLI tooling, while taking advantage of Python’s rich AI ecosystem for the heavy LLM-driven processing.

OpenAnt supports scanning both remote repositories and local directories. It treats each target as a project, running a pipeline where outputs from one stage feed the next, ensuring clear state management and traceability.

The project is open source under the Apache 2 license, aiming to help open source maintainers proactively discover vulnerabilities uncovered through AI techniques.

What distinguishes OpenAnt: technical strengths and tradeoffs

The standout architectural choice is the two-stage pipeline combining AI-driven static analysis with active exploit validation. Most security scanners rely on static detection alone, producing many false positives that require human triage. OpenAnt’s approach automates the validation step, making the tool practical for real-world usage where noise is a significant bottleneck.

This design is an elegant way to leverage LLMs not just for detection but also for validation, reducing alert fatigue.

The polyglot CLI + Python runtime is a pragmatic tradeoff. Go provides a single statically compiled binary for ease of deployment and performance in orchestrating the pipeline. Python 3.11+ is used for AI-heavy tasks, taking advantage of modern language features and AI libraries. The managed virtual environment (~/.openant/venv) auto-created on first use simplifies dependency management but adds some complexity under the hood.

A key limitation is the dependency on an Anthropic API key with access to the Claude Opus 4.6 model. This external dependency introduces cost, rate limits, and potential privacy considerations for sensitive codebases. It also means the tool’s AI capabilities are bounded by Anthropic’s API availability and pricing.

Supporting multiple languages is a strength, but it also means the static analysis stage must handle different parsing and code idioms, which can be challenging to keep robust and up to date.

The code quality appears solid from the README and repo structure. The CLI build process requires Go 1.25+, and the instructions are clear. The tool’s pipeline model is straightforward, making debugging and extending the process easier.

Quick start

Local setup

Build the CLI binary (requires Go 1.25+):

cd apps/openant-cli && make build

This compiles the Go source and outputs the binary to apps/openant-cli/bin/openant.

Symlink it onto your PATH so you can run openant from anywhere:

ln -sf "$(pwd)/apps/openant-cli/bin/openant" /usr/local/bin/openant

Note: run this from the repo root so $(pwd) resolves to the correct absolute path.

Set your Anthropic API key (required for analyze, verify, and scan):

openant set-api-key <your-key>

The key must have access to the Claude Opus 4.6 model. Get a key at console.anthropic.com.

Python runtime

OpenAnt’s parsing, enhancement, analysis, and reporting code is Python 3.11+. The Go CLI picks an interpreter in this order:

  1. OPENANT_PYTHON env var (set this to pin a specific interpreter — e.g. OPENANT_PYTHON=python3.11).
  2. Managed venv at ~/.openant/venv/ (auto-created on first use). The CLI uses bin/python on Linux/macOS and Scripts\python.exe on Windows.
  3. python3 / python on PATH.

If none yield Python 3.11+, the command exits with an error pointing at python.org. To rebuild a stale managed venv (e.g. after upgrading Python), delete ~/.openant/venv/ and rerun any openant command.

verdict

OpenAnt is a solid option if you want to integrate AI-driven vulnerability discovery with automated exploit validation into your security workflow. Its two-stage approach tackles one of the biggest pain points in automated scanning: false positives.

The Anthropic dependency and Python runtime requirement are the main tradeoffs to consider if you want lightweight or fully self-hosted tooling.

For open source maintainers or security teams working with the supported languages, OpenAnt offers a practical, automated way to stay ahead of AI-discovered vulnerabilities without drowning in noise. The codebase is well-structured, and the CLI-centric orchestration makes it suitable for integration into CI/CD pipelines or local audits.

It’s worth exploring if you want to see how LLMs can be paired with active exploit attempts to improve vulnerability triage in real projects.

→ GitHub Repo: knostic/OpenAnt ⭐ 567 · Python