Orchestrated intelligence, not a single model.
HELIX isn't one giant prompt pretending to be an expert at everything. It's a team of specialists, each a focused agent with its own toolset, coordinated by a planner and sharing what they learn.
How the team operates
The planner generates an attack plan in buckets and routes each bucket to a specialized sub-agent with its own offensive toolset. Findings flow through a shared blackboard, so a discovery made by one agent informs the next, recon feeds injection, injection feeds chaining, and a skeptic checks every claim before it ships.
Web
Recon, authentication, access control, injection, business logic and chain hunting.
Web recon
Maps before you wake. Enumerates surface, endpoints and entry points to seed the engagement.
Injection
Payload alchemist. Probes SQLi, XSS, template and command injection with real tooling.
Authentication
Takes keys, never doors. Attacks login, session and token flows for auth weaknesses.
Access control / IDOR
No role too high. Hunts broken access control and insecure direct object references.
Chain hunter
Sees bugs as dominoes. Stitches individual weaknesses into a higher-impact path.
Business logic
Abuses the rules of the application itself, workflows, limits and assumptions that code never enforced.
API
Spec-driven hunting for object- and function-level authorization flaws.
Spec ingestion
Your spec is my map. Ingests OpenAPI, Swagger and GraphQL to model every route and parameter.
BOLA / BFLA
Tests object- and function-level authorization, the access-control flaws that dominate API breaches.
Mass assignment
"You forgot to strip a field." Pushes unexpected fields through endpoints to seize properties the API never meant to expose.
Mobile runtime
Your app dances now. Drives Frida and Objection to instrument iOS and Android binaries at runtime.
Cloud
Maps AWS and Kubernetes exposure and probes IAM privilege escalation, exposed storage and metadata SSRF.
AI & LLM
Asks the model what it shouldn't tell. Drives prompt injection, system-prompt leakage and RAG poisoning.
Coordination
The agents that keep the team honest, organized and reproducible.
Orchestration
Plans the engagement in buckets and routes each one to the right specialist.
Skeptic
Every claim needs a witness. Refutes anything that lacks runtime corroboration.
Reproducibility
Turns confirmed findings into copy-pasteable reproducers anyone can replay.
Reporting
Writes the triaged report, CVSS, CWE and language-specific remediation per finding.
Put the whole team on your target
One planner, dozens of specialists, one triaged report.