Shannon 3.0 Deep Dive: Mantis-Inspired Code Analysis Pipeline, Opus 5 Run Costs $115 With One False Positive

testingcatalog · x · 2026-09-08

Keygraph released Shannon 3.0 (AGPL-3.0), an open-source AI pentester runnable locally via npx.

How it works: Shannon is a CLI agent that reads an app's source code, figures out where it's likely to break, then attacks the running app with real exploits. Anything it can't demonstrate against the live target gets discarded — "no exploit, no report."

What's new in 3.0: A multi-stage security code analysis pipeline adapted from the open-source Mantis security review skills. It first builds its own picture of the app (components, interfaces, dependencies, data flows, trust boundaries, high-value assets), then agents follow attacker-controlled data from entry point to sensitive operation. Candidates are deduplicated, challenged by a review agent, checked for production viability, and confirmed against code paths before entering the exploitation queue. The pass is opt-in; a code analysis hypothesis never becomes a finding on its own.

Benchmarks: On Photoview 2.4.0 (the same app from Doyensec's Aikido-sponsored study), Shannon 3.0 with DeepSeek v4 Flash reported 18 findings for $6.10, Grok 4.6 reported 10 for $35.07, and Opus 5 reported 24 for $115 with one false positive.

Original post →

Shannon 3.0 Deep Dive: Mantis-Inspired Code Analysis Pipeline, Opus 5 Run Costs $115 With One False Positive

More from coding & agent