santosomar/AI-agents-for-cybersecurity

What it is

santosomar/AI-agents-for-cybersecurity is a companion repo for Omar Santos's Pearson and O'Reilly trainings and books. The page says the repo is the current version, so it may be newer than the recordings or printed editions. Each part maps to a module or chapter, and the scripts stand alone.

Preconditions / Affected

• Python 3.13+ and uv are required.
• Most scripts need OPENAI_API_KEY, set in the environment or a local .env file. .env is already in .gitignore.
• The page lists Ollama and Hugging Face examples in Part 1. It does not say whether the later parts run without OpenAI.

What to do

Set up and smoke-test (the smoke test runs offline):

uv sync --python python3.13
uv run python part1_foundational_topics/huggingface_example.py
export OPENAI_API_KEY="your-key-here"

Where to start, by goal:

• Agent tooling: part5_agents_and_mcp_servers/ has the CISA KEV and ethical-hacking LangGraph agents, asm_example/, crewai_example/, deepagents_example/ and mcp_servers_examples/ (FastMCP nmap, KEV, Shodan).
• Evaluating agent frameworks: part6_agentic_frameworks/ has a side-by-side comparison, a "which one for which job" guide, a map of 2026 CVEs and supply-chain incidents, and lab exercises. The page gives no CVE IDs in its text, so check the folder for them.
• Cost controls: part7_tokenomics/07_token_budget_guard.py sets per-task token, cost and loop ceilings as a denial-of-wallet defense. 04_cost_per_outcome.py computes cost per accepted outcome, defined as model + runtime + human review, divided by acceptance rate.
• Designing a gated assessment harness: start at part8_multi-agent_harness_spec/README.md, then read safety-governance.md first. It covers the scope manifest, approval gates G0–G3, lab isolation, budgets, an append-only audit and a kill switch, and it overrides any implementation choice. agents.yaml is the reference configuration with capabilities, gates and hard-stop triggers.

flowchart LR
    A[Part 8 pipeline] --> B[Recon]
    B --> C[Vuln discovery]
    C --> D{Human approval}
    D -- recorded --> E[Exploit validation]
    E --> F{Human approval}
    F -- recorded --> G[Post-exploitation impact]
    D -- none --> H[Disabled by default]
    F -- none --> H
    C --> I[Remediation: recommendations only]

Caveats

• The nmap scanning, Agent Zero on Kali Linux, attack-surface-management and ethical-hacking agent examples act against real systems. Run them only against systems you own or are authorized to test, ideally in an isolated lab.
• Part 8 is a design spec, not runnable code. It has no scanner, payload or service. Exploitation validation and post-exploitation impact stay disabled unless a human records a task-specific approval for a named lab target.
• The page dates Part 8's research to October 2026, and it describes the repo as updated regularly. Expect drift against any book or video.
• Report vulnerabilities in the repo privately via SECURITY.md, not in public issues.