m-sec-org/BreachWeave

What it solves

BreachWeave is designed for intelligent penetration testing and Capture The Flag (CTF) scenarios. It automates the process of discovering vulnerabilities and executing attack chains, reducing the manual effort required to navigate complex security challenges while preventing common AI failures such as task drift, premature termination, and context overload.

How it works

The project uses a multi-agent collaboration architecture consisting of three primary roles:

• Manager: Acts as the control plane, handling global orchestration, scheduling Solvers, and organizing collaboration without executing the attack chains itself.
• Solver: The active agent that performs the actual work, including information gathering, vulnerability verification, and executing the attack chain.
• Observer: A supervisory agent that monitors the execution process to correct path deviations and maintain state without interfering with the Solver's direct decisions.

To maintain efficiency, the system separates "Ideas" (directions to pursue) from "Memory" (verified facts and evidence) and employs context compression and noise reduction to ensure the LLM receives high-signal information.

Who it’s for

Security researchers, authorized penetration testers, and CTF participants who want to automate security testing workflows using an agentic framework.

Highlights

• Multi-Agent Concurrency: Supports multiple Solvers exploring different attack paths simultaneously under a single Manager.
• State Layering: Separates strategic directions from factual evidence to prevent decision-making blur.
• Runtime Supervision: Uses an Observer to provide lightweight correction and prevent the agent from getting stuck or drifting.
• Context Optimization: Implements rewriting and summarization to prevent context window saturation from raw tool outputs.
• Externalized Termination: Uses system-level constraints rather than relying solely on the model's subjective judgment to decide when a task is complete.