.Phobos

Phobos is a security testing framework for web applications that contain AI functionality. It assesses the application's web and AI attack surfaces together, using AI reasoning to prioritize vulnerability testing. It has two target surfaces: Web, covering normal web, API, browser, client-side JavaScript, and service-facing functionality; and AI, covering LLM, agent, tool, retrieval, and AI-mediated functionality. The AI inside Phobos acts as a security brain that interprets the discovered attack surface, selects vulnerability modules, correlates evidence, and chooses the next useful test. It does not replace scanners and is not itself the target.

Phobos uses a registry-driven runner with explicit execution stages. Each module receives the same shared knowledge state and can emit structured observations, findings, and bounded follow-up candidates. The runner rejects unknown modules, inactive modules, invalid stage ordering, oversized runs, and malformed module output. The AI can only select module IDs that exist in the catalog and are eligible for the current configured capabilities; actual execution requires a registered implementation. Cross-layer analysis is part of the core scan pipeline rather than an afterthought. Dynamic web security uses static HTTP and browser runtime modes, with the browser layer implemented with Playwright and bounded by the same scope controls as the HTTP layer. Higher-impact workflows are explicitly opt-in and configuration driven. Phobos is developed as a controlled security-testing platform, not an unrestricted autonomous exploit framework.