Which AI tools do people use to use AI agents for security scans and threat intel?

Across the 24 sourced use cases in this guide, the most used tools are Grok Bot, Claude Code, Claude, Cursor, Gemini 4 Argon.

How much does it cost to get started?

1 of the 24 use cases can start on a free plan. The most common paid starting price is $17/mo (5 use cases). Prices come from each tool's official pricing page.

How long does setup take?

5 of the 24 use cases list a setup time of an hour or less. Each card shows the setup time the builder reported.

Are these real examples?

Yes. Every use case links to its public source (an X post, a Hacker News thread or a GitHub repo) with the author and date, so you can check it yourself.

How to use AI agents for security scans and threat intel

Short answer: Point an agent only at systems you own or are allowed to test, start with read-only scans, and have it report findings with steps to reproduce before it changes anything. Builders below ran long AI pentests and code audits that end in reproducible reports, had a coding agent write adversarial test inputs in CI, caught MCP tool poisoning and schema drift before release, got daily alerts for newly exploited vulnerabilities through a threat intel feed, ran a self-hosted dark web OSINT pipeline, and used a read-only Grok Bot to label sketchy emails, links and wallet requests as safe, suspicious or scam. Review every fix the agent proposes, and never run scans against other people's systems without written permission.

Security scans, threat intel feeds and scam checks people ran with AI agents on systems they own, each linked to its source. 24 matching use cases below, each with a public source.

Looking for something else? Search all 1889 use cases or .

Get started in 3 steps

Get written permission before scanning anything you do not own, and keep the agent's scope to named hosts or repos.
Run scans read-only first and ask for findings with reproduction steps, then approve fixes one at a time.
Add a cheap check to CI (fuzzing or MCP contract tests) so problems are caught on every change, not once a year.

Dev & opsX · @midkernel

Get a daily vulnerability alert by adding a threat intel feed to Grok Bot

Paste the Midkernel Threat Intel URL into Grok Bot as a connector and build a daily alert; the example flagged new additions to CISA's Known Exploited Vulnerabilities list on Oct 23.

See pricing page5 minBeginner

Grok BotMidkernel Threat Intel

Dev & opsX · @TinaMBean

Have an agent run security scans and patch Next.js on your own apps

Tina's Grok Bot runs security scans on her home-grown apps and applies critical Next.js fixes while she does something else.

See pricing page15 minBeginner

Grok BotNext.js

Research & learningHacker News · danlark1

Find a critical PHP vulnerability with Gemini and AI-assisted exploit work

Wiz's researchers used Gemini 4 Argon and GPT-5.6 Sol, with their Wiz Atlas platform, to find a remote code execution bug in PHP, build the exploit, detect attacks and validate the patch. They note models let them adapt the exploit across PHP versions and memory layouts.

$2 in / $10 out per 1M tokensWeeksAdvanced

Gemini 4 ArgonGPT-5.6 Sol

Dev & opsX · @TheCraigHewitt

Track security news against your exact stack with Claude Code and Grok Bot

A non-security founder had Claude Code list every platform, package, version and third-party dependency in his product, then gave that inventory to Grok Bot to keep stored and check against new vulnerabilities.

$17/mo1 hourIntermediate

Claude Code Grok Bot

Personal & lifeHacker News · szert

Have an AI answer your phone and waste scammers' time

Fed up with scam calls, a developer diverted his mobile to a Telnyx number where an OpenAI live voice agent answers. A classifier labels each call as spam, scam or genuine and steers the bot: scammers get strung along, sales calls get a polite no, and real callers get a message taken. He can steer the bot from Telegram mid-call.

See pricing pageA few daysAdvanced

OpenAITelnyxTelegram

Research & learningX · @fedelemantuano

Analyze malware safely without running it, using Codex and Ghidra

A security researcher used REA, Ghidra and Codex to statically analyze a Windows loader without ever executing it.

Free tierHoursAdvanced

OpenAI CodexREAGhidra

Vibe coding & appsX · @doappwithai

Build a security scanner for vibe-coded sites in 48 hours

AppVitals flags exposed keys, open databases and API leaks in AI-built sites. Cursor agents wrote it and Grok Bot orchestrated, in under 48 hours.

$30/mo48 hoursIntermediate

Cursor Grok Bot

Dev & opsHacker News · Labo333

Let a coding agent write adversarial test inputs in CI

LLM Fuzz CI is a GitHub Action where a coding agent writes adversarial inputs for your tests and reports only the ones that fail.

See pricing page20 minIntermediate

LLM Fuzz CIGitHub Actions

Dev & opsHacker News · pwizard234

Catch MCP tool poisoning and schema drift in CI

mcpward is security and contract testing for MCP servers that catches tool poisoning, rug-pulls, schema drift and protocol violations.

See pricing page15 minIntermediate

mcpwardMCP

Personal & lifeX · @shisler671

Check sketchy emails, links and wallet requests before you click

The Pre-Click DoubleCheck template labels a forwarded email, link, invite or wallet request as Safe, Suspicious or Scam, and it is read-only.

See pricing page5 minBeginner

Grok Bot

Marketing & growthX · @heyrimsha

Audit ad accounts across 12 platforms with a Claude Code skill

heyrimsha shared Claude Ads, a free skill where /ads audit checks Google, Meta, YouTube, LinkedIn, TikTok and 7 more platforms, with dated evidence and confidence levels per finding.

See pricing page20 minIntermediate

Claude Code

Personal & lifeX · @alex_prompter

Audit your whole digital life for stolen sessions and exposed keys with one Claude Code prompt

Because infostealer malware takes your logged-in session cookie and skips both your password and 2FA, this Claude Code prompt checks your machine for malware persistence and poisoned packages, scans the disk for exposed API keys, SSH keys and .env files (redacted, never printed), finds forgotten accounts from sign-up emails, finds you on data broker sites and drafts deletions, and builds a rotation plan with passkeys first.

$17/mo1 sessionIntermediate

Claude Code

Dev & opsHacker News · ShredOnArrival

Find hosts advertising a vulnerable PHP version with an AI-assisted scanner

Two coworkers and AI built Php2ShellCheck, an asynchronous header inspection tool that fingerprints PHP and compares it with the PHP2Shell fixed releases.

See pricing page15 minIntermediate

Python

Vibe coding & appsX · @shmopixbzn

Render fuzzy fur with stacked shells in one HTML file

shmopixbzn had Claude Opus 5.5 build a peach with fuzz made of 32 stacked transparent shells, plus physics and a comb that leaves marks, all in one HTML file.

See pricing page1 hourIntermediate

Claude

Dev & opsX · @mika_systems

Get most of an enterprise AI security scanner for free with open-source repos

With Claude Security limited to Enterprise, a roundup lists free repos that run on Claude Code: airsec for local multi-pass audits, paranoid's /hack-me that attacks your running app and proves each bug with a real request, security-harness with SARIF/JSON/PDF reports, claude-security-scan for a read-only sweep, prod-readiness with a SHIP/FIX/HOLD verdict, and jev-guard that scores every tool call.

$17/mo1 hrIntermediate

Claude Code

Dev & opsHacker News · bemeeker

Give your team a self-hosted place to deploy AI-built apps with vulnerability scans

Pando is an open-source platform to deploy and share apps built with AI inside an organization or family, and it scans each app for known vulnerabilities.

See pricing page30 minIntermediate

Pando

Dev & opsHacker News · coding-maniac

Run a self-hosted dark web threat intel pipeline from one query to a graph

A security researcher built VoidAccess, an open-source, self-hosted platform that automates dark web OSINT in 13 steps, from a search query to a graph, while filtering noise and NSFW content.

See pricing page1 hrAdvanced

VoidAccess

Personal & lifeX · @nft_dreww

Use a Grok Bot template that screens your inbox for phishing

Inbox Guardian is a free Grok Bot template that watches your inbox around the clock and stops phishing and scam emails before you act on them. The creator built it with Grok.

$30/mo10 minutesBeginner

Grok Bot

Personal & lifeX · @wyrjerry111

Let your AI assistant flag scammy cold emails before your call

A user had already booked a Sunday call with a cold-email "web dev" who wanted to collaborate. His Grok Bot flagged the email on its own: the name did not match the address, among other red flags.

$30/mo0 minutesBeginner

Grok Bot

Dev & opsX · @0xrux

Pentest your vibe-coded app with Strix before attackers do

Strix is an open-source AI pentesting tool. Instead of only scanning code, it actively tests your running app for issues like SQL injection and XSS and tries to prove each one is exploitable.

$17/mo1 hourIntermediate

Claude Code

Dev & opsHacker News · VigilOSS

Run long AI pentests and code audits that end in reproducible reports

Vigil is an AI harness for long-running code audits, web pentests and bug bounty hunting, built around how investigations fail: anchored hypotheses, false negatives and unreproducible reports.

See pricing page1 hrAdvanced

Vigil

Dev & opsX · @_quinnwins

Audit product copy line-by-line with a Claude Code skill

Built a Claude Code skill that tests each line of UI copy by asking what a user would misunderstand without it.

$17/mo1-2 hoursIntermediate

Claude Code

Dev & opsHacker News · NickySlicks

Run a local AI pentesting agent on a smartphone

Built Nightcrawler, a local AI pentesting agent that runs on a smartphone.

See pricing page1 dayAdvanced

Ollama

Research & learningHacker News · ritsource

Use AI agents for OSINT and SIGINT research

Shipped AI Agents for Osint/Sigint and shared it as a Show HN.

See pricing page1-2 hoursIntermediate

Common questions

How do you use AI agents for security scans and threat intel?: Point an agent only at systems you own or are allowed to test, start with read-only scans, and have it report findings with steps to reproduce before it changes anything. Builders below ran long AI pentests and code audits that end in reproducible reports, had a coding agent write adversarial test inputs in CI, caught MCP tool poisoning and schema drift before release, got daily alerts for newly exploited vulnerabilities through a threat intel feed, ran a self-hosted dark web OSINT pipeline, and used a read-only Grok Bot to label sketchy emails, links and wallet requests as safe, suspicious or scam. Review every fix the agent proposes, and never run scans against other people's systems without written permission.
Which AI tools do people use to use AI agents for security scans and threat intel?: Across the 24 sourced use cases in this guide, the most used tools are Grok Bot, Claude Code, Claude, Cursor, Gemini 4 Argon.
How much does it cost to get started?: 1 of the 24 use cases can start on a free plan. The most common paid starting price is $17/mo (5 use cases). Prices come from each tool's official pricing page.
How long does setup take?: 5 of the 24 use cases list a setup time of an hour or less. Each card shows the setup time the builder reported.
Are these real examples?: Yes. Every use case links to its public source (an X post, a Hacker News thread or a GitHub repo) with the author and date, so you can check it yourself.

More how-to guides