Announcing Suijin

William Jiang — Fri, 21 Aug 2026 05:55:04 +0000

Check out Suijin here

Security testing, defense and penetration testing today is completely broken. Manual pentesting is too slow to keep up with the rapidly evolving security landscape. Packaged, simple script based security tools can no longer keep up with the creative methods of the attackers of 2026.

The developer community's answer was fully autonomous AI agents. These agents are smart and work in theory, but come with massive caveats and won't work and fall apart in the field.

What if your red/blue team could run 24/7, adapt to what it finds, write dynamic exploits, write reports, and defend your site and find bug bounties all at the same time? What if you could snap the modules together like Lego to adapt to each and every scenario?

Meet Suijin.

Introduction

I'm William, the dev behind Suijin, a fully open-source, automatic dual mode offensive/defensive cybersecurity framework.

The Red Team is an AI agent, powered by SOTA models that can autonomously do reconaissance, save leaked credentials, and write and chain exploits to legitimately think like a real redteamer and find vulnerabilities in your own software or find bug bounties in web apps and web services online.

The Blue Team is a team of AI agents, like an SOC running in your terminal. The team of AI agents can intelligently discern between threats and normal requests and respond by deceiving the attacker, creating honeypots, and blocking the IP before they even have time to think.

Both tools share one toolkit, one knowledge graph and one knowledge base. They can run independently or together, all at the same time.

What really sets us apart

Most AI tools are paperweights when air-gapped or without an API key. Suijin can use its heuristic bypass and built in knowledge base to defend or attack in an airgapped environment.

We've all seen what an AI agent does with too much autonomy. Suijin has built in human-governance, strict scope enforcement, cost caps and zero-cost supervisors that can detect when something is going wrong, and a policy engine that can detect dangerous patterns before the agent hits enter.

Red Team can attack and Blue Team can defend in Suijin Battle mode where you can watch the AI agents battle each other with live tarpitting, exploits and network blocks and scripts, closest thing to a real purple teaming exercise that you are ever going to see on your own laptop.

Inspiration

One day I was doing a classic penetration test on a web service when I realised I was doing the same command, similar exploits, over and over again on the same few endpoints. Why couldn't this be automatic?

And I tried the other automatic, script based tools. But there was always an issue. The moment a single character was wrong, the whole pipeline failed. Why?

And from that day onward, I began my work on Suijin.

It took many days of planning, coding, iterating, debugging before I got to my v1 release, adding tools, commands, changing the skill build up until it was a MVP.

What Suijin brings

Suijin brings:

260+ agent tools — nmap, sqlmap, gobuster, Metasploit, custom KB tools, and more
Offline knowledge base — HackTricks, GTFOBins, PayloadsAllTheThings, SecLists — all indexed with FTS5
Built-in labs — 8 deliberately vulnerable apps (SQLi, XSS, Log4j, SSTI, command injection, and more)
Supervisor — zero-cost pattern detector that catches loops, stalls, and missed flags with no LLM cost
Battle mode — red vs blue live, with scoring, tarpitting, network blocks, and battle reports
Modular OS architecture — kernel + tiers + installable modules = extensible and maintainable
HITL + governance — human approvals, policy enforcement, scope controls, audit trails

Built in labs

We didn't want you to learn on real targets. Suijin ships with 8 deliberately vulnerable Flask apps, including blue_target — a 25-endpoint app with SQLi, XSS, SSTI, command injection, IDOR, XXE, and more. Launch one, point Suijin at it, and watch the agent get to work.

It's the safest way to learn red teaming and blue teaming at the same time.

Get Started

Getting started takes one command:

curl -fsSL https://raw.githubusercontent.com/0xwi11iam/Suijin/main/install.sh | bash
suijin doctor && suijin selftest
suijin

That's it. A security OS on your machine.

We built Suijin because we believe open-source security tools should be powerful, accessible, and safe. We've put hundreds of hours into making this work — and we're just getting started.

Star the repo. File an issue. Contribute a module. Share this with your team.

The future of security is autonomous. Let's build it together!

My Mac Was a $2000 Brick. Here's How I Gained Root Access in 5 Minutes

William Jiang — Wed, 29 Jul 2026 14:09:01 +0000

I built https://github.com/0xwi11iam/macos-evilmaid to help those who are locked out of their Macs.

With this tool, with just a USB drive and Recovery Mode you can regain root access to your Mac in under 5 minutes without deleting any files and not touching ANYTHING that might damage your system.

I remember the exact moment I realized I was stuck.

I was sitting in front of my own Mac—a machine I paid for with my own money—and I couldn't do anything with it. I had standard user permissions. No sudo. No admin access. No way to install the tools I needed. No way to fix the problem.

It wasn't malicious. It wasn't stolen. It was just... locked down. MDM. A provisioning profile from an organization that had long since forgotten I existed. And I was trapped in my own hardware.

I spent days trawling through forums, GitHub issues, and ancient StackExchange threads. Everything I found was either: completely outdated (10.12 Sierra-era fixes that no longer work), dangerously destructive (suggestions to wipe the entire drive), or vague and unhelpful ("just use Recovery Mode" with no actual steps).

I was stuck in a dead zone—a technical problem that was just obscure enough that nobody had written a clear, modern, working solution.

So I built one.

This is macos-evilmaid — a tool that lets you regain root access on an MDM-locked Mac in under 5 minutes, using nothing more than a USB drive and Recovery Mode.

Here's what it does:

You boot into Recovery Mode (⌘+R or power button on Apple Silicon).
You run build.sh from a USB drive.
The script drops a LaunchDaemon that runs as root on the next boot.
You connect to the resulting reverse shell via nc.
You enable the root user with dsenableroot.
You're done. Full admin access. No files deleted. No data lost.

It works on macOS Sequoia (untested on Tahoe, but likely compatible). It targets the data volume (/private/var/tmp/ and /Library/LaunchDaemons/), so it doesn't break the system volume seal.

But I didn't just release a script. I documented everything:

The attack chain—so you understand what's happening under the hood.
The mitigations—so you can harden your own systems against this.
The detection methods—so blue teams know what to look for.
The ethical boundaries—so there's no confusion about when this is legal and when it's not.

This is the tool I wished existed a year ago. I built it so nobody else has to waste days searching for a fix that doesn't exist.

Thanks!

DEV Community: William Jiang