🔴 Currently accepting 3 advisory clients for Q3 2026. Email me or DM on LinkedIn.
Author: Siva Aditya Panuganti (Security Researcher)
Track Record: 6+ CVEs and GHSAs in production AI systems via responsible disclosure to BSI Germany, CERT-EE, and GitHub Security:
- CVE-2026-22038 — AutoGPT secrets leak
- GHSA-x58f-9m57-qc4m — FlowiseAI sandbox escape
- CVE-2025-68621 — Trilium Notes timing side-channel
- GHSA-p97p-7x96-7wj5 — LLaMmlein deserialization RCE
ASL V6 is a research-grade vulnerability assessment and red-teaming engine for Python and AI agent codebases. It combines Abstract Syntax Tree (AST) code analysis with live Docker runtime testing to verify real security flaws without flooding developers with false alerts.
- 10 Security Analyzers: Examines code for OWASP Top 10 LLM and Agent vulnerabilities, including prompt injection sinks, goal hijacking, unsafe code execution (
eval/exec), and tool abuse. - AST Contextual Filtering: Parses Python syntax trees to ignore test suites, mock files, and docstrings. This eliminates around 98% of false positive alerts.
- Live Docker Runtime Verification: Runs untrusted code snippets inside isolated ephemeral Docker containers (
python:3.11-slim) to confirm whether an injection is exploitable in a live runtime environment. - Remediation Patch Generation (Optional): Generates structured code fixes and patch suggestions. Works offline using deterministic AST rules, or can connect to NVIDIA developer API endpoints if an API key is provided.
ASL V6 is free and open-source under the MIT License.
- 100% Local Execution: The analyzers, AST filters, and Docker runtime tests execute locally on your machine. They do not send data over the internet or consume API tokens.
- Bring Your Own Key (Optional): If you want LLM-assisted code patch suggestions, you can provide your own free developer API key via the
NVIDIA_API_KEYenvironment variable. If no key is provided, the tool automatically uses offline rule-based patch suggestions at zero cost.
ASL V6 was tested on popular open-source AI frameworks to measure its detection coverage. Results show pattern-match counts before and after AST contextual filtering:
| Repository | Files | Raw Patterns | Filtered Signals | Noise Reduction | Runtime Probe |
|---|---|---|---|---|---|
| LangGraph | 513 | 606 | 13 | 97.9% | Available |
| Weaviate | 501 | 682 | 9 | 98.7% | Available |
| Rasa | — | 703 | 12 | 98.3% | Available |
| ASL V6 Engine | 7 | 48 | 0 | 100.0% | Available |
Note: These are automated pattern-match counts, not confirmed vulnerabilities. Manual review and responsible disclosure are required to verify exploitability. ASL V6 is a research tool, not a certified security scanner.
git clone https://github.com/sivaadityacoder/asl-v6.git
cd asl-v6
pip install -r requirements.txtpython3 v6_ai_infra_security.py /path/to/your/projectpython3 v6_ai_benchmarks.py /path/to/repo1 /path/to/repo2You can use the included GitHub Actions workflow (asl_v6_ci_cd_action.yml) to automatically check pull requests for security flaws during your CI/CD build process.
Don't want to run it yourself? I offer a one-time assessment:
- Codebase Scan + Report: $1,500 fixed price
- Includes: Full ASL V6 scan, verified findings report, remediation guidance
- Delivered within 5 business days
- Email: adityasecuritylabs@gmail.com
An automated test engine helps find known patterns, but securing custom agent architectures requires manual review. I work directly with engineering teams on a retainer or fixed-project basis:
- Advisory Retainer ($2,500 / month): Monthly architecture review, manual vulnerability discovery, and remediation pull requests written directly for your codebase.
- Emergency Security Assessment ($5,000 fixed): 1-week pre-launch code audit or post-incident review with proof-of-concept exploits and remediation guidance.
- EU AI Act Technical Documentation ($3,500 - $5,000 fixed): Technical robustness testing and adversarial documentation for European compliance.
Contact: adityasecuritylabs@gmail.com | GitHub Profile