Hound - Autonomous AI Security Auditor with Knowledge Graphs

Hound - Autonomous AI Security Auditor with Knowledge Graphs

Research Date: January 26, 2026 Source URL: https://github.com/scabench-org/hound Academic Paper: https://arxiv.org/abs/2510.09633 Version at Research: Commit from October 15, 2025 (no tagged releases) License: Apache 2.0

Overview

Hound is a language-agnostic AI auditor that autonomously builds and refines adaptive knowledge graphs for deep, iterative code reasoning in security audits. It introduces a relation-first graph engine that enables system-level reasoning across interrelated components in complex codebases.

Core Value Proposition: Transform manual security auditing into autonomous AI-driven analysis using flexible knowledge graphs, belief systems, and hypothesis-driven investigation.

Problem Addressed

Key Statistics (as of January 26, 2026)

Key Features

1. Graph-Driven Analysis

• Flexible Agent-Designed Graphs: Model any aspect of a system (architecture, access control, value flows, math)
• Relational Graph Views: High-level graphs support cross-aspect reasoning
• Code Snippet Anchoring: Precise retrieval of code backing each subsystem investigated
• System Architecture Graph: Automatic baseline graph generation

2. Belief and Hypothesis System

• Persistent Hypotheses: Long-lived vulnerability findings with confidence scores (0.0-1.0)
• Evidence Accumulation: Confidence updated as evidence accrues across sessions
• Status Lifecycle: proposed -> investigating -> confirmed/rejected
• Severity Classification: Critical, high, medium, low
• Type Classification: Reentrancy, access control, logic error, etc.

3. Dynamic Model Switching

• Scout Models: Lightweight models (GPT-4o-mini) handle exploration
• Strategist Models: Heavyweight models (GPT-5, Claude Opus) provide deep reasoning
• Cost Efficiency: Expert workflows mirrored while keeping costs efficient
• Multi-Provider Support: OpenAI, Anthropic, Google Gemini (Vertex AI)

4. Strategic Audit Planning

• Coverage vs Intuition Balance: Broad code coverage with focused investigation
• Sweep Mode: Systematic component analysis for initial discovery
• Intuition Mode: Deep, targeted exploration for high-impact vulnerabilities
• Per-Session Planning: PlanStore with statuses (planned, in_progress, done, dropped, superseded)

5. Interactive Steering (Chatbot UI)

• Real-time Monitoring: Live activity, plan, and findings
• Manual Steering: Guide investigations via web interface
• Session Management: Attach/detach from running audits
• Manual Hypothesis Control: Confirm/reject findings manually

Technical Architecture

User Input (Codebase Path)
         |
         v
+-------------------------+
|   Project Creation      |
|   - Code ingestion      |
|   - File whitelisting   |
+-------------------------+
         |
         v
+-------------------------+
|   Knowledge Graph Build |
|   - SystemArchitecture  |
|   - Custom aspects      |
|   - Graph refinement    |
+-------------------------+
         |
         v
+-------------------------+
|   Agent Audit           |
|   - Sweep mode          |
|   - Intuition mode      |
|   - Scout/Strategist    |
+-------------------------+
         |
         v
+-------------------------+
|   Hypothesis Store      |
|   - Evidence tracking   |
|   - Confidence scores   |
|   - Status management   |
+-------------------------+
         |
         v
+-------------------------+
|   QA Finalization       |
|   - Reasoning review    |
|   - Confirm/reject      |
+-------------------------+
         |
         v
+-------------------------+
|   Report Generation     |
|   - HTML output         |
|   - PoC integration     |
|   - Professional format |
+-------------------------+

Senior/Junior Pattern

The audit uses a two-tier agent architecture:

1. Junior (Scout): Lightweight models for exploration and coverage
2. Senior (Strategist): Heavyweight reasoning models for planning and deep analysis

Graph Types

Hound supports multiple analyst-defined graph types:

• SystemArchitecture: Baseline component relationships
• CallGraph: Function call relationships across modules
• ValueFlows: Monetary and value transfer paths
• AuthRoles: Authentication and authorization relationships
• ProtocolInvariants: System-wide invariant tracking

Audit Workflow

Phase 1: Project Setup

# Create project from local code
./hound.py project create myaudit /path/to/code

# List projects
./hound.py project ls

Phase 2: Build Knowledge Graphs

# Auto-generate graphs (recommended)
./hound.py graph build myaudit --auto \
  --files "src/A.sol,src/B.sol,src/utils/Lib.sol"

# Or manual graph creation
./hound.py graph custom myaudit \
  "Call graph focusing on function call relationships" \
  --iterations 2 --files "..."

Phase 3: Run Audit

# Sweep: Systematic component analysis
./hound.py agent audit myaudit --mode sweep

# Intuition: Deep targeted exploration
./hound.py agent audit myaudit --mode intuition --time-limit 300

# With telemetry for interactive steering
./hound.py agent audit myaudit --mode intuition --telemetry

Phase 4: Finalize and Report

# QA review with reasoning model
./hound.py finalize myaudit

# Generate professional HTML report
./hound.py report myaudit

Benchmark Results (from Paper)

On a five-project subset of ScaBench:

Key Insight: Gains attributed to flexible relation-first graphs extending model understanding beyond call/dataflow to abstract aspects, plus the hypothesis-centric loop.

Relevance to Claude Code Development

Direct Applications

1. Hypothesis-Driven Investigation: Model for scientific verification workflows in Claude Code agents
2. Knowledge Graph Patterns: Approach for building contextual understanding of large codebases
3. Belief System Design: Pattern for maintaining confidence-scored findings across sessions
4. Coverage Tracking: Methods for ensuring systematic analysis of code components

Patterns Worth Adopting

1. Scout/Strategist Model Switching: Cost-efficient model selection based on task complexity
2. Graph-Based Code Navigation: Precise retrieval using relationship-aware graphs
3. Session Persistence: Maintaining investigation state across interruptions
4. Coverage vs Intuition Balance: Balancing breadth and depth in analysis
5. Interactive Steering: Real-time human guidance during autonomous operations

Integration Opportunities

1. Security-Focused Skill: Create Claude Code skill for security auditing workflows
2. Hypothesis Pattern: Adopt for verification and debugging workflows
3. Graph Construction: Patterns for building codebase knowledge graphs
4. Report Generation: Professional report templates for audit findings

Installation

# Clone repository
git clone https://github.com/scabench-org/hound.git
cd hound

# Install dependencies
pip install -r requirements.txt

# Configure API keys
export OPENAI_API_KEY=your_key_here
# Optional: Anthropic, Google Vertex AI

# Copy and edit config
cp hound/config.yaml.example hound/config.yaml

Configuration Options

Model Configuration:

• Scout model: Lightweight exploration (default: gpt-4o-mini)
• Strategist model: Deep reasoning (default: gpt-5)
• QA finalizer: Hypothesis review (default: gpt-5)

Provider Support:

• OpenAI (GPT-4, GPT-4o, GPT-5)
• Anthropic (Claude-3-Opus)
• Google Gemini via Vertex AI

Graph Options:

• Auto-generation with --auto
• Custom aspect definitions
• File whitelisting with --files
• Iteration control for refinement

References

1. GitHub Repository: https://github.com/scabench-org/hound (accessed 2026-01-26)
2. Academic Paper: Mueller, B. "Hound: Relation-First Knowledge Graphs for Complex-System Reasoning in Security Audits" arXiv:2510.09633 [cs.CR] (2025-09-29)
3. Paper Abstract: https://arxiv.org/abs/2510.09633 (accessed 2026-01-26)
4. Author Walkthrough: https://muellerberndt.medium.com/hunting-for-security-bugs-in-code-with-ai-agents-a-full-walkthrough-a0dc24e1adf0
5. ScaBench Benchmark: Referenced in paper as evaluation dataset

Freshness Tracking

Change Detection Indicators:

• Monitor GitHub for new commits and releases
• Check for paper updates on arXiv
• Review issues for feature announcements
• Track star growth (671 -> goal tracking)