Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Zero shot vulnerability discovery using LLMs
| Date | Stars |
|---|---|
| 2026-07-31 | 2722 |
| 2026-08-03 | 2722 |
| 2026-08-06 | 2722 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
<div align="center">
<img width="250" src="https://github.com/user-attachments/assets/d1153ab4-df29-4955-ad49-1be7fad18bb3" alt="Vulnhuntr Logo">
A tool to identify remotely exploitable vulnerabilities using LLMs and static code analysis.
**World's first autonomous AI-discovered 0day vulnerabilities**
</div>
## Description
Vulnhuntr leverages the power of LLMs to automatically create and analyze entire code call chains starting from remote user input and ending at server output for detection of complex, multi-step, security-bypassing vulnerabilities that go far beyond what traditional static code analysis tools are capable of performing. See all the details including the Vulnhuntr output for all the 0-days here: [Protect AI Vulnhuntr Blog](https://protectai.com/threat-research/vulnhuntr-first-0-day-vulnerabilities)
## Vulnerabilities Found
> [!TIP]
> Found a vulnerability using Vulnhuntr? Submit a report to [huntr.com](https://huntr.com) to get $$ and submit a PR to add it to the list below!
> [!NOTE]
> This table is just a sample of the vulnerabilities found so far. We will unredact as responsible disclosure periods end.
| Repository | Stars | Vulnerabilities |
| - | - | - |
| [gpt_academic](https://github.com/binary-husky/gpt_academic) | 67k | [LFI](https://nvd.nist.gov/vuln/detail/CVE-2024-10100), [XSS](https://nvd.nist.gov/vuln/detail/CVE-2024-10101) |
| [ComfyUI](https://github.com/comfyanonymous/ComfyUI) | 66k | [XSS](https://nvd.nist.gov/vuln/detail/CVE-2024-10099) |
| [Langflow](https://github.com/langflow-ai/langflow) | 46k | RCE, IDOR |
| [FastChat](https://github.com/lm-sys/FastChat) | 37k | [SSRF](https://nvd.nist.gov/vuln/detail/CVE-2024-10044) |
| [Ragflow](https://github.com/infiniflow/ragflow) | 31k | [RCE](https://nvd.nist.gov/vuln/detail/CVE-2024-10131) |
| [LLaVA](https://github.com/haotian-liu/LLaVA) | 21k | [SSRF](https://www.cve.org/CVERecord?id=CVE-2024-9309) |
| [gpt-researcher](https://github.com/assafelovic/gpt-researcher) | 17k | [AFO](https://github.com/assafelovic/gpt-researcher/pull/935) |
| [Letta](https://github.com/letta-ai/letta) | 14k | [AFO](https://github.com/letta-ai/letta/pull/2067) |
## Limitations
- Only Python codebases are supported.
- Can only identify the following vulnerability classes:
- Local file include (LFI)
- Arbitrary file overwrite (AFO)
- Remote code execution (RCE)
- Cross site scripting (XSS)
- SQL Injection (SQLI)
- Server side request forgery (SSRF)
- Insecure Direct Object Reference (IDOR)
## Installation
> [!IMPORTANT]
> Vulnhuntr strictly requires Python 3.10 because of a number of bugs in Jedi which it uses to parse Python code. It will not work reliably if installed with any other versions of Python.
We recommend using [pipx](https://github.com/pypa/pipx) or Docker to easily install and run Vulnhuntr.
Using Docker:
```bash
docker build -t vulnhuntr https://github.com/protectai/vulnhuntr.git#main
```
Using pipx:
```bash
pipx install git+https://github.com/protectai/vulnhuntr.git --python python3.10
```
Alternatively you can install directly from source using poetry:
```bash
git clone https://github.com/protectai/vulnhuntr
cd vulnhuntr && poetry install
```
## Usage
This tool is designed to analyze a GitHub repository for potential remotely exploitable vulnerabilities. The tool requires an API key and the local path to a GitHub repository. You may also optionally specify a custom endpoint for the LLM service.
> [!CAUTION]
> Always set spending limits or closely monitor costs with the LLM provider you use. This tool has the potential to rack up hefty bills as it tries to fit as much code in the LLMs context window as possible.
> [!TIP]
> We recommend using Claude for the LLM. Through testing we have had better results with it over GPT.
### Command Line Interface
```
usage: vulnhuntr [-h] -r ROOT [-a ANALYZE] [-l {claude,gpt,ollama}] [-v]
Analyze a GitHub project for vulnerabilities. Export your ANTHROPIC_API_KEY/OPENAI_API_KExcerpt of 10,389 characters
Read on GitHub
21
16
6
Ikko Eltociear Ashimine · Japan
1
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:3e59a86983be8ede, topic:llm