LIVE · PUBLIC SCANS
▸ public_scans

What you inherit when you install an AI agent.

We read the source of 12 popular agent frameworks and mapped 8,447 dangerous action surfaces. Shipped in the box; reachability we can't rule out — live the moment your agent reads untrusted content. Two distinct tiers: 596 reachable in-repo, and 542 install-liability.

The tiers differ by our evidence, not your safety. Neither is a clean bill of health — and we stamp zero as proven-live.

12FRAMEWORKS AUDITED
8,447ACTION SURFACES MAPPED
596REACHABLE IN-REPO
542INSTALL-LIABILITY

▸ doubt these numbers? see exactly how we define and rate a surface · the methodology →

Scan your repo — free → Read the research report →
pip install hermes-shield-scanner

then hermes-shield demo · v0.8.2 · PyPI · GitHub

then run hermes-shield scan in your own repo

▸ the_numbers

Read from source. Counted, not estimated.

STATIC AUDIT · PINNED COMMITS 8,447 mapped · 596 reachable · 542 install-liability
▸ 0 FRAMEWORKS AUDITED Every one read from source, line by line.
0 STARS ACROSS THE FRAMEWORKS WE SCAN Their popularity — not ours — multiplies the install-liability.
▸ scan_results

Named repos. Named counts.

Every row below comes from a pinned commit we read ourselves — the eight named frameworks from our 12-framework audit, ordered by what each one ships. Ratings follow OWASP severity conventions for the class of surface found.

▸ honesty

None of the surfaces below are proven-live. Every count is static reachability from source, and where a call is ambiguous we leave it out. We under-report.

261
SURFACES

cua

trycua/cuaOWASP · HIGH19.5k ★

261 inherited surfaces on a computer-use execution path — full desktop control: keyboard, mouse, screen. The largest single inheritance we found across all 12 audits.

47
SURFACES

Langflow

langflow-ai/langflowOWASP · MED151k ★

47 inherited surfaces through a code-execution flow node, shipped to a community of 151k GitHub stars. Popularity multiplies the install-liability, not just the reach.

34
SURFACES

letta

letta-ai/lettaOWASP · MED23.7k ★

34 inherited surfaces along the agent and tool execution path. A memory-first agent framework where every install quietly inherits the lot, used or not.

26
SURFACES

llama_index

run-llama/llama_indexOWASP · MED50.7k ★

26 inherited surfaces — code-execution and deserialisation paths that run over untrusted documents. See CVE-2023-39662 for how this class of surface has already gone live in the wild.

22
SURFACES

SuperAGI

TransformerOptimus/SuperAGIOWASP · MED17.6k ★

22 inherited surfaces where agent tools execute on untrusted content. The classic pattern: the capability is one untrusted page from firing.

20
SURFACES

agno

agno-agi/agnoOWASP · MED41k ★

20 inherited surfaces along a multi-agent tool execution path. Every agent in the swarm inherits the same set — the count compounds with the architecture.

15
SURFACES

semantic-kernel

microsoft/semantic-kernelOWASP · LOW28.3k ★

15 inherited surfaces on the plugin and planner execution path in Microsoft's agent framework. One of the lowest counts of the named set — even the most carefully engineered frameworks still ship some.

11
SURFACES

babyagi

yoheinakajima/babyagiOWASP · LOW22.3k ★

11 inherited surfaces in the task-execution loop. The smallest inheritance we name here — and still eleven surfaces more than most teams know they installed.

▸ reachable_we_cannot_rule_out

Dormant in the repo. Live the moment your agent reads the wrong page.

▸ the risk class: OWASP LLM06 · Excessive Agency

▸ methodology

How we counted — and where we stop.

We would rather under-report than over-claim. Every number on this page comes with its method attached.

read-only, pinned

  • Read-only static analysis, pinned commits
  • We never execute the frameworks
  • We never probe live systems
  • Every finding re-derivable from the same commit

proven-live: 0

  • None of the 8,447 mapped surfaces are proven-live
  • Across all 12 frameworks — and we say so
  • Static reachability is the honest claim
  • Live exploitation is a different bar

blast radius

  • At 1M installs, 542 install-liability surfaces project to  542M
  • Inherited surfaces in the field
  • Illustrative arithmetic, not a measurement
  • But the direction is the point
▸ your_repo_here

Scan your own repo, free.

The number that matters is not on this page. It is yours: what your agents inherited the day you installed them. The scanner is free and installable today. A default scan runs fully local and reads your code read-only, nothing is sent anywhere. The optional --ai tier uses your own local Claude CLI, the only mode that sends code text, and it goes to Anthropic’s API under your own account.

pip install hermes-shield-scanner

then hermes-shield demo · v0.8.2 · PyPI · GitHub

Scan your repo — free → PyPI GitHub

Want your public repo added to this page? We run a concierge public scan (public repos only) — request a public scan →

Public Scans — What You Inherit When You Install an AI Agent