AgentHound is an open-source offensive security framework for AI agent infrastructure, hosted on GitHub with about 450 stars under the Apache-2.0 license and active development in 2026. It positions itself as a BloodHound for the agentic stack: it maps how AI systems connect, then finds the attack paths between them.
As organizations wire up MCP servers, A2A agents, model gateways, inference servers, vector stores, and MLOps tooling, the security surface becomes a graph problem, much like Active Directory was for BloodHound. AgentHound performs reconnaissance across those planes and analyzes attack paths involving credential looting, model exfiltration, and poisoning, using graph analysis backed by Neo4j. The project was presented at DEF CON 34’s Red Team Village, ships documentation on its site, and stresses authorized use only: it can actively validate credentials and invoke models when prerequisites are present, so it should only be run against systems you own or are engaged to test.
The framework covers every plane of the agentic stack, from agent clients and protocol servers to the inference and data layers underneath them. Its safety documentation is explicit about operational security: findings can include live credentials, so results must be handled like the secrets they expose. For defenders, the same attack-path output doubles as a hardening checklist for agent deployments.
AgentHound is free and open source under the Apache-2.0 license. There is no commercial tier; you run it in your own environment against systems you are authorized to assess.
It is aimed at red teamers, penetration testers, and AI platform security engineers who need to audit agent infrastructure the way BloodHound audits Active Directory, finding chained weaknesses before an attacker does.