heretic-agent added to PyPI

A new tool named HERETIC has been introduced to the Python Package Index (PyPI), designed to identify business-logic vulnerabilities in applications. This autonomous AI agent is particularly notable for its ability to detect vulnerabilities such as Broken Object Level Authorization (BOLA), Insecure Direct Object References (IDOR), price tampering, workflow bypass, and data exposure. Verified by Oracle, HERETIC boasts a remarkably low false positive rate of approximately zero, setting it apart from traditional bug scanners and human penetration testers.

Understanding HERETIC's Functionality

HERETIC operates as a command-line interface (CLI) tool, similar to well-known security tools like nmap and sqlmap. Its primary function is to analyze an application's business intent and systematically attempt to breach it. Unlike conventional signature scanners that identify specific vulnerabilities like Cross-Site Scripting (XSS) or SQL Injection (SQLi), HERETIC targets the roughly 70% of critical web bugs that lack identifiable patterns. These vulnerabilities often arise when an application behaves as instructed but violates business rules.

The tool employs a large language model (LLM) to reason about the intent behind an application’s code. However, it does not rely solely on the LLM's output to confirm vulnerabilities. Instead, HERETIC utilizes a deterministic Oracle to validate each finding, ensuring that the reported vulnerabilities are accurate and reproducible. This dual approach enhances the reliability of the tool, as it combines the reasoning capabilities of AI with the precision of deterministic code.

HERETIC has demonstrated its effectiveness in real-world scenarios, successfully identifying five different business-logic classes within a live application using a single command and maintaining a zero false positive rate. The tool can also detect instances where the LLM generates incorrect information, such as non-existent endpoints, and automatically adjusts its analysis based on the actual application surface.

Features and Capabilities

The tool currently covers nine business-logic vulnerability classes, with seven being fully mechanical and two relying on LLM-driven processes. It is designed to work seamlessly in both offline and live environments, allowing users to run assessments without needing an AI key for certain deterministic classes. This flexibility makes HERETIC accessible for various use cases, whether for quick assessments or more comprehensive evaluations.

The installation process is straightforward, requiring Python 3.11 or higher. Users can execute HERETIC with minimal configuration, making it an appealing option for those who may not have extensive experience with security testing tools. The tool can generate detailed HTML reports of its findings, providing users with clear documentation of vulnerabilities and their potential impacts.

HERETIC also incorporates robust security measures to ensure that it is used responsibly. It emphasizes the importance of authorized testing, explicitly stating that users should only assess systems they own or have permission to evaluate. This focus on ethical usage is critical in the realm of security testing, where unauthorized access can lead to serious legal repercussions.

Why it matters

The introduction of HERETIC to the security testing landscape is significant for both creators and technologists. For developers, the tool provides a powerful means of identifying critical vulnerabilities that traditional scanners may overlook. By focusing on business logic rather than merely code patterns, HERETIC enables teams to strengthen their applications against real-world attacks that exploit logical flaws.

For technologists, HERETIC represents a convergence of AI and security testing, showcasing how machine learning can enhance the effectiveness of vulnerability assessments. The tool's ability to reason about intent while ensuring accuracy through deterministic validation could pave the way for more advanced security solutions in the future.

Moreover, HERETIC's low false positive rate is particularly beneficial for development teams, as it reduces the noise often associated with security testing. This allows teams to focus on genuine vulnerabilities rather than wasting time sifting through false alarms. As organizations increasingly prioritize security in their development processes, tools like HERETIC will likely become essential components of their security arsenals.

In conclusion, HERETIC's launch on PyPI marks a notable advancement in the field of security testing, providing a specialized tool that addresses the complexities of business-logic vulnerabilities. Its innovative approach, combining AI reasoning with deterministic validation, offers a promising avenue for improving application security practices across various industries.