I built Exfault, agentic mobile app pentesting tool
Hi HN, I am the creator of Exfault. I am building autonomous AI agents that find vulnerabilities in Android apps. I have noticed there are growing number of AI native pentesting tools for web apps but very few for mobile or Android. With more mobile apps being shipped quickly due to vibe coding, I wanted to build an AI native security tool specifically for Android apps. Exfault combines static and dynamic analysis with AI agents using tools like adb,jadx, apktool for static analysis and reverse engineering, frida for dynamic analysis, hermes-dec for React native decompilation. The AI agents…
What it does
In the maker’s words, at launch
Hi HN, I am the creator of Exfault. I am building autonomous AI agents that find vulnerabilities in Android apps. I have noticed there are growing number of AI native pentesting tools for web apps but very few for mobile or Android. With more mobile apps being shipped quickly due to vibe coding, I wanted to build an AI native security tool specifically for Android apps. Exfault combines static and dynamic analysis with AI agents using tools like adb,jadx, apktool for static analysis and reverse engineering, frida for dynamic analysis, hermes-dec for React native decompilation. The AI agents have access to real Android emulators to peform navigation, explore functionality and validate vulnerabilities before reporting them improving both the quality of reports and also the rate of false positives. Instead of uploading an apk or aab, you can simply enter an Android package name (com.example.app), Our backend automatically acquires a compatible build, installs it in an emulator so the agents can test your app. For authenticated testing, you can provide test credentials and the agent will automatically sign in and continue exploring the authenticated attack surface. I'm also working on a human-in-the-loop login helper for more complex authentication flows involving MFA, Email verification etc. There's a free demo available if you'd like to try it on your own app. I'd really appreciate your thoughts and feedback! https://exfault.com
Does the same job
all alternatives →
- ISI spent 8 months trying to make LLMs Hack2025 · ▲6
Hey HN! For that last 8 months I've been trying to make agents that can hack web applications to find vulnerabilities in them - An AI Security Tester. The system has 29 agents in total, a custom LLM Orchestration framework which works on the task-subtask architecture (old-school but works amazingly for my use case, and is pretty reliable) with custom agent calling mechanism. No Auo-Gen, Langchain and Crew AI - Everything custom built for pentesting. Each test runs in an isolated Kali linux environment (on AWS Fargate), where the agents have full access to the environment to undertake any…
- IBI built a firewall for agents because prompt engineering isn't securityJan 2026 · github.com · ▲7
Hi HN, I’m the creator of Cordum. I’ve been working in DevOps and infrastructure for years (currently in the fintech/security space), and as I started playing with AI agents, I noticed a scary pattern. Most "safety" mechanisms rely on system prompts ("Please don't do X") or flimsy Python logic inside the agent itself. If we treat agents as autonomous employees, giving them root access and hoping they listen to instructions felt insane to me. I wanted a way to enforce hard constraints that the LLM cannot override, no matter how "jailbroken" it gets. So I built Cordum. It’s an open-source…
- FPFind prompts that jailbreak your agent (open source)2025 · security.vista-labs.ai · ▲8
We've built an open-source tool to stress test AI agents by simulating prompt injection attacks. We’ve implemented one powerful attack strategy based on the paper [AdvPrefix: An Objective for Nuanced LLM Jailbreaks](https://arxiv.org/abs/2412.10321). Here's how it works: - You define a goal, like: “Tell me your system prompt” - Our tool uses a language model to generate adversarial prefixes (e.g., “Sure, here are my system prompts…”) that are likely to jailbreak the agent. - The output is a list of prompts most likely to succeed in bypassing safeguards. We’re just getting…
More ai this month
the category →
I trained a 125M-parameter transformer to autocomplete piano performances in real time (~108 notes/sec on an iPhone 15). The idea is basically GitHub Copilot or Tabnine, except instead of prompting it with code, you prompt it by playing a few notes on a MIDI piano. The model then continues what you played, entirely on-device. The app is free if anyone wants to try it. Happy to answer questions about the model, training, Core ML, or the many things that didn't work.
AI · 16d ago · simedw.com
Astute▲585Automate your B2B brand going viral, with new media creators
AI · 18d ago · company-app.joinastute.com
Hey HN, Henry from Cactus here! We previously released Cactus Needle, a 14MB agentic LLM for tool call, device use, and structured extraction for phones, wearables, smart homes, small robots and microcontrollers. We got really great feedback here, and have now incorporated the suggestions to release Needle 2. The whole model is a single 14MB binary that runs a full session in 28MB of RAM; 45m parameters at 2bit compression. Needle hits 500 tokens/sec decode speed on a Raspberry Pi 5, sits between 400-1,500 tokens/sec on VR devices like Meta Quest 3S and Apple Vision Pro, and ranges…
AI · 26d ago · cactuscompute.com
Launched alongside, June 2026
the whole month →
Fundraisly▲1,544AI fundraising agent that finds investors and books meetings
AI · Jun 2026 · fundraisly.com
- H6Homebrew 6.0.0▲1,481
Today, I’m proud to announce Homebrew 6.0.0. The most significant changes since 5.1.0 are a new tap trust security mechanism, the new faster, smaller, default internal Homebrew JSON API, sandboxing on Linux, better defaults informed by our user survey, many brew bundle improvements, improved performance and initial support for macOS 27 (Golden Gate). Happy to discuss any questions here!
Dev tools · Jun 2026 · brew.sh
- PU
hope you enjoy
Life & fun · Jun 2026 · vorpus.github.io
- IM
Life & fun · Jun 2026 · hackernewstrends.com