Safety & Limitations

Read this before running Shannon in a new environment.

Shannon executes real exploits

Shannon is not a passive scanner. Its exploitation agents can create users, submit forms, mutate application state, trigger outbound requests, and otherwise affect the target system.

Authorized use only

Shannon is designed for legitimate security auditing. You must have explicit written authorization from the owner of the target system before running Shannon.

Unauthorized scanning or exploitation of systems you do not own is illegal. Keygraph is not responsible for misuse of Shannon.

Do not run on production

Shannon’s exploitation agents actively execute attacks to confirm vulnerabilities. This can mutate application state and data.

Do not run Shannon against production systems. Use sandboxed, staging, or local development environments where data integrity is not a concern. For maximum isolation, run Shannon inside a disposable virtual machine.

Potential mutative effects include:

• Creating new users
• Modifying or deleting data
• Compromising test accounts
• Triggering unintended side effects from injection attacks
• Generating unexpected outbound traffic
• Writing exploit artifacts to reports or deliverables

LLM and automation caveats

• Verification is required. Shannon uses a proof-by-exploitation methodology, but final reports can still contain weakly supported or incorrect details. Human review is essential.
• Model support. Shannon is provider-agnostic. Anthropic, OpenAI, xAI, and AWS Bedrock are built in, and any other provider in the Pi harness catalogue, compatible LLM gateways, and local models served by Ollama, vLLM, or LM Studio also work (see AI Providers). Results vary by model. A model that does not follow Shannon’s instructions or tool-use constraints reliably may produce incomplete, inaccurate, or unstable runs.
• Prompt injection risk. Do not point Shannon at untrusted or adversarial codebases. AI-powered tools that read source code can be influenced by malicious repository content.

Scope of analysis

Shannon currently targets exploitable vulnerabilities in these classes:

• Broken Authentication
• Broken Authorization
• Injection
• Cross-Site Scripting
• Server-Side Request Forgery

Shannon’s proof-by-exploitation model means it does not report issues it cannot actively exploit, such as many vulnerable-dependency, insecure-configuration, or broad-policy findings.

For broader coverage, the Keygraph platform adds black-box and white-box agentic pentesting, graph-based static analysis, SCA reachability, secrets detection, business logic testing, remediation workflows, SLA tracking, and reporting dashboards.

Cost and performance

A full test run typically takes a few hours. LLM API costs vary by model pricing, target complexity, selected provider, and concurrency. Enabling security code analysis adds model time and cost.

If you use subscription-based model access, see Subscriptions in AI Providers for the supported plans.