Kanti Labs

Overview

Kanti Labs (kantilabs.xyz) is an AI security research lab building open-weight models, datasets, and public write-ups for offensive web security — especially XSS detection within the Strix agent framework.

The lab publishes Strix-specialized Qwen3 fine-tunes on Hugging Face (kusonooyasumi org): supervised XSS Strix traces from HackerOne-style data, plus RL-trained 4B proof-of-concepts for autonomous vulnerability hunting sub-agents.

OFFSITE.DARK cites Kanti Labs as the research-origin source for Greps entries in the Strix XSS model line — same attribution pattern as Hugging Face community uploads indexed for capability benchmarking, not endorsement.

Treat kantilabs.xyz model cards, Prime Intellect eval environments, and Strix integration docs as research infrastructure for tracking specialized offensive LLM releases — not as endorsement of use outside authorized testing.

Primary use cases

• Indexing Strix XSS agent models after Hugging Face upload
• Cross-referencing SFT vs RL training approaches for web vuln agents
• Benchmarking open-weight XSS reasoning against general cyber LLMs
• Tracking dataset lineage (strix_xss_hackerone) for eval reproducibility

Detection / defense notes

• Monitor for Strix or custom XSS-agent tooling in unauthorized scan traffic
• Assume specialized XSS models lower skill floor for scripted hunting — prioritize WAF, CSP, and output encoding over model blocking

Related tools

• Shannon — White-box web pentester from Keygraph. Reads source repos, maps attack surfaces, runs browser and CLI exploits in Docker workers. Reports only validated PoCs. AGPL CLI; targets Injection, XSS, SSRF, auth, and authorization flaws.
• Sploitus — Exploit and tool search engine. Aggregates Exploit-DB, GitHub PoCs, and Metasploit modules into one query interface.
• Keygraph — Commercial AppSec platform built on Shannon. Code Property Graph SAST, continuous pentest runs, finding deduplication, auto-remediation PRs with re-test verification. Self-hosted and air-gapped deployment.