# Show HN: ASL V6 – Open-source AST red-teaming engine for Python AI agents

> Source: <https://github.com/sivaadityacoder/asl-v6>
> Published: 2026-07-27 03:50:55+00:00

🔴

Currently accepting 3 advisory clients for Q3 2026.[Email me]or[DM on LinkedIn].

**Author:** Siva Aditya Panuganti (Security Researcher)

**Track Record:** 6+ CVEs and GHSAs in production AI systems via responsible disclosure to BSI Germany, CERT-EE, and GitHub Security:

[CVE-2026-22038](https://nvd.nist.gov/vuln/detail/CVE-2026-22038)— AutoGPT secrets leak[GHSA-x58f-9m57-qc4m](https://github.com/advisories/GHSA-x58f-9m57-qc4m)— FlowiseAI sandbox escape[CVE-2025-68621](https://nvd.nist.gov/vuln/detail/CVE-2025-68621)— Trilium Notes timing side-channel[GHSA-p97p-7x96-7wj5](https://github.com/advisories/GHSA-p97p-7x96-7wj5)— LLaMmlein deserialization RCE

ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases. It combines Abstract Syntax Tree (AST) code analysis with live Docker runtime testing to verify real security flaws without flooding developers with false alerts.

**10 Security Analyzers:** Examines code for OWASP Top 10 LLM and Agent vulnerabilities, including prompt injection sinks, goal hijacking, unsafe code execution (`eval`

/`exec`

), and tool abuse.**AST Contextual Filtering:** Parses Python syntax trees to ignore test suites, mock files, and docstrings. This eliminates around 98% of false positive alerts.**Live Docker Runtime Verification:** Runs untrusted code snippets inside isolated ephemeral Docker containers (`python:3.11-slim`

) to confirm whether an injection is exploitable in a live runtime environment.**Remediation Patch Generation (Optional):** Generates structured code fixes and patch suggestions. Works offline using deterministic AST rules, or can connect to NVIDIA developer API endpoints if an API key is provided.

ASL V6 is free and open-source under the MIT License.

**100% Local Execution:** The analyzers, AST filters, and Docker runtime tests execute locally on your machine. They do not send data over the internet or consume API tokens.**Bring Your Own Key (Optional):** If you want LLM-assisted code patch suggestions, you can provide your own free developer API key via the`NVIDIA_API_KEY`

environment variable. If no key is provided, the tool automatically uses offline rule-based patch suggestions at zero cost.

Tested on real filesystem repositories:

| Repository | Files Scanned | Raw Alerts | Validated True Positives | False Positive Reduction | Runtime Verification |
|---|---|---|---|---|---|
LangGraph |
513 | 606 | 13 |
97.9% |
`VERIFIED IN RUNTIME` |
ASL V6 Engine |
7 | 48 | 0 |
100.0% |
`VERIFIED IN RUNTIME` |

```
git clone https://github.com/sivaadityacoder/asl-v6.git
cd asl-v6
pip install -r requirements.txt
python3 v6_ai_infra_security.py /path/to/your/project
python3 v6_ai_benchmarks.py /path/to/repo1 /path/to/repo2
```

You can use the included GitHub Actions workflow (`asl_v6_ci_cd_action.yml`

) to automatically check pull requests for security flaws during your CI/CD build process.

An automated test engine helps find known patterns, but securing custom agent architectures requires manual review. I work directly with engineering teams on a retainer or fixed-project basis:

**Advisory Retainer ($2,500 / month):** Monthly architecture review, manual vulnerability discovery, and remediation pull requests written directly for your codebase.**Emergency Security Assessment ($5,000 fixed):** 1-week pre-launch code audit or post-incident review with proof-of-concept exploits and remediation guidance.**EU AI Act Technical Documentation ($3,500 - $5,000 fixed):** Technical robustness testing and adversarial documentation for European compliance.

**Contact:** [adityasecuritylabs@gmail.com](mailto:adityasecuritylabs@gmail.com) | [GitHub Profile](https://github.com/sivaadityacoder)