9 Security Repos on GitHub Defenders Should Know Right Now (October 2026)
AI agents are all over GitHub this month, and security is no exception. This morning, Thursday 15 October, I checked GitHub’s trending pages and searched GitHub for security, pentest, malware-analysis and reverse-engineering repos with commits in October. Then I pulled each repo’s star count from the GitHub API. Every number below is as of 15 October 2026, 12:52 to 12:57 PM IST.
A quick word on momentum. GitHub’s trending pages give a real “stars this week” or “this month” figure, but only two of these repos were on them today. For the rest I say plainly that I don’t have a momentum number. I’d rather do that than guess.
I also dropped one repo. morluto/rea topped the weekly chart with 214,837 stars in a week and about 252,000 in total, for a repo created in April 2026. Most of its stars arrived in a single week, which I can’t explain, so I left it out.
One rule for everything below: only point these tools at systems you own or have written permission to test. Several of them actively probe or attack software. That’s how defenders find holes first, but running them against someone else’s system can be illegal.
1. NationalSecurityAgency/ghidra
Repo: github.com/NationalSecurityAgency/ghidra
A software reverse-engineering framework from the US National Security Agency. It takes compiled programs apart so you can see what they do.
Who it’s for: malware analysts, incident responders and students learning how binaries work.
Stars: 87,892. Momentum: 5,613 stars this week and 11,461 this month (GitHub weekly and monthly trending).
My take: It’s an old repo, created in 2019, and it’s still climbing both trending lists. AI-assisted malware like CLOSEDQUORUM is exactly the kind of sample analysts open in a tool like this. It’s free and Apache-licensed, which makes it the obvious place to start learning.
2. NVIDIA/OpenShell
Repo: github.com/NVIDIA/OpenShell
Its description calls it “the safe, private runtime for autonomous AI agents”, a contained place for agents to run.
Who it’s for: teams letting AI agents run commands who want limits on what those agents can touch.
Stars: 16,272. Momentum: 7,698 stars this month (GitHub monthly trending).
My take: This one is purely defensive. If an agent can run shell commands, it needs a fence. Read what it does and doesn’t isolate before you trust it with real credentials.
3. usestrix/strix
Repo: github.com/usestrix/strix
An open-source AI penetration-testing tool, by its own description built to “find and fix your app’s vulnerabilities”.
Who it’s for: app teams who want automated security testing of their own code.
Stars: 68,665. Momentum: not on today’s trending pages. It ranks third among repos tagged “security” with October commits in GitHub’s search.
My take: AI pentesters are the busiest corner of security GitHub right now. Run it only on your own apps, ideally in staging, because it does real testing.
4. KeygraphHQ/shannon
Repo: github.com/KeygraphHQ/shannon
An AI pentester for web apps and APIs. Its description says it reads your source code, finds attack paths and runs real exploits to prove each bug before release.
Who it’s for: developers and security teams testing their own web apps before launch.
Stars: 48,889. Momentum: not on today’s trending pages, so I don’t have a number.
My take: “Executes real exploits” is the line to take seriously. Use it on a test copy you own, never production. It’s AGPL-3.0, so check the licence if you plan to build on it.
5. openai/codex-security
Repo: github.com/openai/codex-security
OpenAI’s Codex Security command-line tool and TypeScript SDK for finding, validating and fixing security bugs in code.
Who it’s for: developers who want security checks inside an AI coding workflow.
Stars: 11,107. Momentum: not on today’s trending pages. It’s the most-starred repo tagged “security” created since April 2026 in GitHub’s search.
My take: Created only in July 2026 and already past 11,000 stars, which tracks with how much AI labs are pushing into security testing. That’s a story I covered with ENISA’s tests of Mythos 5 and GPT-6 Astra. A tool that suggests fixes still needs a human to review them.
6. aquasecurity/trivy
Repo: github.com/aquasecurity/trivy
A scanner for known vulnerabilities, misconfigurations and leaked secrets in containers, Kubernetes, code repos and cloud setups. It can also produce an SBOM, a list of what’s inside your software.
Who it’s for: DevOps and platform teams.
Stars: 38,429. Momentum: not on today’s trending pages, so I don’t have a number. It had a commit this morning.
My take: If you only add one tool to a build pipeline this month, this is the sensible kind: it checks your own stuff and breaks nothing.
7. projectdiscovery/nuclei
Repo: github.com/projectdiscovery/nuclei
A fast vulnerability scanner driven by simple YAML templates that the community writes and shares, including templates for newly disclosed bugs.
Who it’s for: security teams checking their own apps, APIs and cloud setups for known issues.
Stars: 32,043. Momentum: not on today’s trending pages, so I don’t have a number.
My take: Community templates help when a new bug lands and you need to know quickly whether you’re exposed. Scan only the assets you’re responsible for.
8. WerWolv/ImHex
Repo: github.com/WerWolv/ImHex
A hex editor for reverse engineers and programmers, for looking at raw bytes inside files.
Who it’s for: anyone who needs to see what is really inside a file format or firmware image.
Stars: 55,204. Momentum: not on today’s trending pages, so I don’t have a number.
My take: A good companion to a tool like Ghidra, and useful well beyond security. It’s GPL-2.0.
9. mandiant/capa
Repo: github.com/mandiant/capa
From Mandiant’s FLARE team: it scans an executable file and lists what that program is capable of.
Who it’s for: malware triage and incident response teams.
Stars: 6,239. Momentum: not on today’s trending pages, so I don’t have a number.
My take: The smallest repo here, but it answers the first question in any malware case: what can this file do? Run unknown samples only inside an isolated analysis machine.
What I’d do next
Pick one defensive tool, such as Trivy or capa, and run it against something you own this week. A container image or a file you already distrust is a good start. Leave the AI pentesters for a staging copy, with permission in writing.
If you’d rather keep the AI side of your testing entirely on your own machine, here’s how I run AI with Kali fully offline.
Leave a comment