ExploitBot v1.5.3 — Bounded Reasoning and Responsive Live Streaming

ExploitBot v1.5.3 — Bounded Reasoning and Responsive Live Streaming

This hotfix addresses a main-thread freeze found during the final v1.5.2 demo
drive.

Fixes

• Treats explicit one-tool requests followed by summary, answer, reply, or
  report language as bounded turns, freezes the request to the one named tool,
  and disables unnecessary Qwen reasoning for the deterministic call and final.
• Publishes accumulated reasoning and answer text to SwiftUI at a fixed 10 Hz
  cadence, with an explicit main-actor yield after each visible update. Every
  SSE delta remains accumulated immediately and the final tail is preserved.
• Renders bounded live and completed previews for long reasoning and assistant
  responses. The full transcript remains available to Copy and Stash without
  repeatedly laying out the entire growing string.
• Keeps the full capability inventory in its visible tool card while sending
  only the grounded callback outcome to the bounded final request, preventing
  raw inventory copying and unwanted count narration.
• Uses Apple's non-accelerated notary upload path to avoid the transient S3
  acceleration failure observed during the previous release.

Safety and scope

ExploitBot is intended for systems you own or are explicitly authorized to
test. This release does not broaden tool scope or bypass approval policy.

ExploitBot v1.5.2 — Discovery, Evidence, and Agent Loop Stability

ExploitBot v1.5.2 — Discovery, Evidence, and Agent Loop Stability

This release focuses on making live operator sessions faster, calmer, and more
auditable.

Highlights

• Reworked the chat header and panel geometry so status, cache, tool, and decode
  metrics remain readable across supported window sizes.
• Throttled streamed content, reasoning, telemetry, and tool previews to keep
  SwiftUI responsive during long generations and verbose command output.
• Added bounded direct-answer and post-tool finalization lanes for Qwen so
  simple no-tool questions and completed tool turns reach a clean final answer
  without reopening an unbounded reasoning loop.
• Hardened engine supervision: transient health-check failures no longer trigger
  immediate destructive restarts, while a confirmed process exit still does.
• Added intent-specific capability packs capped at eight schemas per ordinary
  model request, plus capability discovery for the full 50-tool registry.
• Added a compact context compiler and typed evidence, execution, and artifact
  stores so the model receives relevant findings instead of an ever-growing raw
  transcript.
• Added native local discovery for interfaces, routes, neighbors, Bonjour,
  Wi-Fi, and Bluetooth with permission-aware status. Discovery reports metadata
  only and does not execute pentest commands.
• Improved finding creation, report generation/export, stash organization,
  activity filtering, agent controls, and evidence provenance throughout the UI.

Safety and scope

ExploitBot is intended for systems you own or are explicitly authorized to
test. Native discovery and capability discovery do not expand authorization;
active tools remain subject to operation scope and approval policy.

ExploitBot v1.5.1 — Demo Stability Fixes

Fixes chat header/metrics layout, streaming UI starvation, stale stop/tool state races, repeated exact tool calls, and missing terminal SSE finish reasons. Live-tested with Qwen3.6 reasoning and a completed approved run_shell loop. Developer ID signed, Apple notarized, and stapled. SHA-256 values are recorded in the attached release manifest.

ExploitBot v1.5.0 — Local Pentesting on Apple Silicon

ExploitBot v1.5.0 is the signed and notarized demo release.

Highlights:

• Local Qwen 3.6 and MiniMax reasoning, streaming, and structured tool workflows
• Native depth-3 MTP, TurboQuant Q4 KV cache, paged/prefix cache, and disk L2 telemetry
• Deterministic tool-schema injection and correct interleaved reasoning placement
• Visible external-target approval cards with Allow once, per-operation allow, and Block
• Persisted operations, chat/results state, model settings, and cache configuration
• Live prefill, cached-token, TTFT, and decode-throughput indicators
• Single-instance protection and hardened engine lifecycle handling

Distribution:

• Developer ID signed with hardened runtime
• Apple notarized and stapled app and DMG
• Requires macOS 14 or later on Apple Silicon

SHA-256 is recorded in the attached release-manifest.json.

ExploitBot 0.1.0 Beta

Beta DMG for Apple Silicon macOS.

Artifact:

• DMG: ExploitBot-beta.dmg
• SHA256: 647bfa9e662c21e37b0cb79473fcf415a6ce058c15097c321dfa23440660175e
• App binary SHA256: 855a02af65313950fa88944d1c2dc9d4fd4772ea1ec5c6a403893515a4ed0bce
• Signing: Developer ID Application, hardened runtime
• Notarization: app and DMG submitted, stapled, and validated

Verification performed:

• codesign app and DMG verification
• stapler validation for app and DMG
• Gatekeeper spctl accepted app as Notarized Developer ID
• hdiutil verify passed for DMG
• public GitHub DMG download matched the SHA256 above

Current beta scope:

• Qwen MXFP4-MTP and MiniMax text/runtime lanes
• Qwen hybrid SSM cache and MiniMax full-KV cache proofing
• TurboQuant q4 KV, prefix cache, paged cache, block L2, and warm replay checks
• CVE import/search, supply-chain workflows, visible tool status, logs, stash, and reports

Known beta gaps:

• Qwen-specific multimodal/VL promotion is not final
• Full MiniMax JANG_K live load/chat/cache pass still needs a quiet high-RAM run
• Longer realistic autonomous pentest runs are still needed beyond bounded proof harnesses

ExploitBot v1.4.1 — Autonomous Pentesting on Apple Silicon

ExploitBot v1.4.1

Autonomous penetration testing powered by local LLMs on Apple Silicon.

What's New

• 37 pentesting tools integrated (nmap, nuclei, sqlmap, ffuf, dalfox, and more)
• 3-phase automation: SCAN → DETECT → BREACH with auto-advance
• Multi-agent system: deploy parallel scanning agents from chat
• 1,552 CISA KEV CVEs bundled with search + live NVD lookup
• Model profiles: Quick/Medium/Large auto-adapts settings per model size
• Inference metrics: tok/s, TTFT, cached tokens visible during streaming
• Full cache control: prefix cache, paged cache, KV quantization (q4/q8)

All Tabs Functional

Every subtab has real content with per-subtab buttons, inputs, and filters:

• Recon: Subdomains, Ports, Web Hosts, Crawl, OSINT
• Web: Vulns, SQLi, XSS, Dirs, Params, SSL, JWT (subtab-aware scan commands)
• Network: Protocols, SNMP, Capture, MITM, Tunnels
• Creds: Cracking, Online Brute, Secrets, Vault
• Exploit: Metasploit, Reverse Shells (one-liner templates), Custom Scripts, C2
• Post-Exploit: PrivEsc, AD Attacks, Lateral Movement
• OSINT: Username, Email, Metadata, Screenshots

Requirements

• macOS 14+ (Apple Silicon)
• Python 3.11+ (for vMLX engine)
• A local MLX/JANG model (downloaded via Settings)

Install

1. Open the DMG
2. Drag ExploitBot to Applications
3. Open ExploitBot
4. Go to Settings → select a model path → click Start

Tools

Tools are detected from your system PATH. Install via Homebrew:

brew install nmap nuclei subfinder ffuf sqlmap hashcat hydra dalfox feroxbuster katana dnsx trufflehog exiftool testssl
pip3 install sherlock-project holehe arjun