Entropy – API security testing using LLMs to generate attack scenarios

Name: Entropy – API security testing using LLMs to generate attack scenarios
Availability: InStock
Author: arjinexe

by arjinexe·Mar 5, 2026·2 points·1 comment

Visit Project View on HN

AI Analysis

●●SolidBig BrainWizardry

LLM-generated attack personas beat static scanners, but Burp Suite + custom rules solve this already.

Strengths

•Five parallel attacker personas (insider, bot swarm, etc.) go beyond typical payload lists
•Baseline diffing avoids false positives by comparing responses against clean state
•Works on OpenAPI, GraphQL, or autodiscovered endpoints without spec files

Weaknesses

•Relies entirely on LLM quality—bad prompts mean bad attacks; no evaluation against real CVEs
•Traditional scanners (Burp, Zap) + BDD frameworks already solve business logic testing

Post Description

I built Entropy to solve a specific problem: traditional API scanners often miss business logic flaws because they rely on static attack lists. Entropy uses LLMs to analyze your API schema (OpenAPI/GraphQL) and think like an adversary to generate custom attack sequences.Note: I'm currently fixing a small packaging issue, so "pip install" might be temporarily unavailable for the next few hours. In the meantime, you can run it directly from the source by cloning the repo. I'd love to hear your thoughts and feedback!