An Open-Source AI Red Team That Actually Files CVEs

What it does

DeepAudit is a multi-agent system that audits codebases for security vulnerabilities. It ingests projects from GitHub, GitLab, or Gitea, runs coordinated LLM-driven analysis, and validates findings in an automated sandbox. Results are exported as PDF, Markdown, or JSON reports. The stack pairs a React/TypeScript frontend with a FastAPI/Python backend, and the system can run fully offline via Ollama.

The interesting bit

Instead of a single model pass, DeepAudit treats auditing as a team sport: multiple agents collaborate with specialized roles and leave real-time reasoning logs. The maintainers track success by actual advisories, claiming 49 CVEs and 6 GHSAs across projects like Dataease, Zentao PMS, and PowerJob—not just theoretical scan results.

Key highlights

• Claims 49 CVEs and 6 GHSAs found across 17 open-source projects, with CVSS scores listed
• Multi-agent audit flow with real-time logs showing agent reasoning
• Supports private Ollama deployment and “transfer station” API relay configurations
• Imports repos from GitHub, GitLab, and Gitea for batch project management
• One-click report generation in PDF, Markdown, or JSON formats
• AGPL-3.0 licensed

Caveats

• The README is heavy on vulnerability trophies but light on architectural specifics; how the agents coordinate and how the sandbox isolates PoCs is not clearly detailed in the visible sections
• Bulk findings are heavily concentrated in single projects (for example, numerous XSS entries in one repository), so the diversity of claimed discoveries is narrower than the headline suggests
• Features like “transfer station” and the distinction between fast mode and Agent mode are referenced but not explained

Verdict

Worth a look if you want an open-source security scanner with a published CVE track record. Pass if you need deep documentation on agent internals and sandbox mechanics before trusting results.