Show HN: ASL V6 – Open-source AST red-teaming engine for Python AI agents

Security researcher Siva Aditya Panuganti released ASL V6, an open-source AST red-teaming engine for Python AI agents that combines abstract syntax tree analysis with live Docker runtime testing to verify security flaws. The tool, which is free under the MIT License, achieved a 97.9% false positive reduction on LangGraph and a 100% reduction on its own engine during testing. Panuganti, who holds 6+ CVEs and GHSAs in production AI systems, is also accepting advisory clients for Q3 2026.

🔴 Currently accepting 3 advisory clients for Q3 2026. Email me or DM on LinkedIn . Author: Siva Aditya Panuganti Security Researcher Track Record: 6+ CVEs and GHSAs in production AI systems via responsible disclosure to BSI Germany, CERT-EE, and GitHub Security: CVE-2026-22038 https://nvd.nist.gov/vuln/detail/CVE-2026-22038 — AutoGPT secrets leak GHSA-x58f-9m57-qc4m https://github.com/advisories/GHSA-x58f-9m57-qc4m — FlowiseAI sandbox escape CVE-2025-68621 https://nvd.nist.gov/vuln/detail/CVE-2025-68621 — Trilium Notes timing side-channel GHSA-p97p-7x96-7wj5 https://github.com/advisories/GHSA-p97p-7x96-7wj5 — LLaMmlein deserialization RCE ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases. It combines Abstract Syntax Tree AST code analysis with live Docker runtime testing to verify real security flaws without flooding developers with false alerts. 10 Security Analyzers: Examines code for OWASP Top 10 LLM and Agent vulnerabilities, including prompt injection sinks, goal hijacking, unsafe code execution eval / exec , and tool abuse. AST Contextual Filtering: Parses Python syntax trees to ignore test suites, mock files, and docstrings. This eliminates around 98% of false positive alerts. Live Docker Runtime Verification: Runs untrusted code snippets inside isolated ephemeral Docker containers python:3.11-slim to confirm whether an injection is exploitable in a live runtime environment. Remediation Patch Generation Optional : Generates structured code fixes and patch suggestions. Works offline using deterministic AST rules, or can connect to NVIDIA developer API endpoints if an API key is provided. ASL V6 is free and open-source under the MIT License. 100% Local Execution: The analyzers, AST filters, and Docker runtime tests execute locally on your machine. They do not send data over the internet or consume API tokens. Bring Your Own Key Optional : If you want LLM-assisted code patch suggestions, you can provide your own free developer API key via the NVIDIA API KEY environment variable. If no key is provided, the tool automatically uses offline rule-based patch suggestions at zero cost. Tested on real filesystem repositories: | Repository | Files Scanned | Raw Alerts | Validated True Positives | False Positive Reduction | Runtime Verification | |---|---|---|---|---|---| LangGraph | 513 | 606 | 13 | 97.9% | VERIFIED IN RUNTIME | ASL V6 Engine | 7 | 48 | 0 | 100.0% | VERIFIED IN RUNTIME | git clone https://github.com/sivaadityacoder/asl-v6.git cd asl-v6 pip install -r requirements.txt python3 v6 ai infra security.py /path/to/your/project python3 v6 ai benchmarks.py /path/to/repo1 /path/to/repo2 You can use the included GitHub Actions workflow asl v6 ci cd action.yml to automatically check pull requests for security flaws during your CI/CD build process. An automated test engine helps find known patterns, but securing custom agent architectures requires manual review. I work directly with engineering teams on a retainer or fixed-project basis: Advisory Retainer $2,500 / month : Monthly architecture review, manual vulnerability discovery, and remediation pull requests written directly for your codebase. Emergency Security Assessment $5,000 fixed : 1-week pre-launch code audit or post-incident review with proof-of-concept exploits and remediation guidance. EU AI Act Technical Documentation $3,500 - $5,000 fixed : Technical robustness testing and adversarial documentation for European compliance. Contact: adityasecuritylabs@gmail.com mailto:adityasecuritylabs@gmail.com | GitHub Profile https://github.com/sivaadityacoder