Today’s headline is our own stack: NousResearch/hermes-agent shipped v0.22.0 on 10-14, the first release since our September CVE-2026-14625 line — confirmation, Sir, that the alarm is retired and the harness marches on. Out in the wilds the agent sweep keeps accelerating, but with it comes a fog of implausible velocity: morluto/rea (238k★, born today), ponytail (~160k★ in four months), and scientific-agent-skills all carry marketing that outruns contributorship — I should sooner trust a reasoned review than a star count. VoiceStudio’s 25k-star week is real and hot, yet it remains beta with AGPL cloning surface — import for voice, not for trust. And garak, promptfoo and iFixAi consolidate the grown-up practice of auditing the agents we run. Test before you trust, verify before you adopt — Zero Trust applies to star counts as much as to networks, as you well know, Sir.
All star counts, pushed_at, latest-release tags and language fields verified verified 2026-10-15 via authenticated GitHub REST API via the authenticated GitHub REST API (repo + releases/latest endpoints). Daily GitHub Trending list pulled live from github.com/trending on 2026-10-15 (12 repos). Weekly commit counts are 7-day deltas (since 2026-10-07) capped at 100 per repo per API page — figures of 100 indicate ≥100 commits in the window, not an exact total. Star-velocity deltas vs the 2026-10-04 baseline are noted only where both snapshots are verified; no metric is invented. Astroturf flags mark repos whose growth outpaces plausible contributorship for a niche. Offensive tooling (pentagi, CyberStrike, NeuroSploit) is flagged dual-use — authorised scope / isolated lab only. CISA KEV / EPSS not re-queried for CVE-2026-14625 (fixed well before this release).
| Item | Latest release | Last push | New 7d (advisories/CVEs) | Status |
|---|---|---|---|---|
| NousResearch/hermes-agent | v0.22.0 (2026-10-14) | 2026-10-14 | CVE-2026-14625 fixed (≤0.15.2); now v0.22.0 | UPDATE |
| ollama/ollama | v0.40.4 (2026-10-12) | 2026-10-14 | No advisories | UPDATE |
| open-webui/open-webui | v0.12.1 (2026-10-14) | 2026-10-14 | No advisories | UPDATE |
| home-assistant/core | 2026.10.1 (2026-10-10) | 2026-10-14 | 2026.10 train; no advisories | UPDATE |
| community-scripts/ProxmoxVE | 2026-10-13 (2026-10-14) | 2026-10-14 | No advisories | UPDATE |
| wazuh/wazuh | v4.14.8 (2026-09-25) | 2026-10-14 | Fixes sometimes ship without public CVE IDs (5.0 beta) | ADVISORY |
| firecrawl/firecrawl | v2.11.0 (2026-06-19) | 2026-10-14 | No advisories | UPDATE |
| langgenius/dify | 1.17.1 (2026-09-10) | 2026-10-14 | No advisories | UPDATE |
| # | Repo | Lang | Stars today | Description | In report |
|---|---|---|---|---|---|
| 1 | morluto/rea | TypeScript | (masked/sign-in) | Reverse engineer anything with agents, from app behavior down to native binaries. | Wildcard / Emerging |
| 2 | debpalash/VoiceStudio | Python | (masked/sign-in) | Open-source, fully-local ElevenLabs alternative — voice cloning, design, video. | Wildcard / Emerging |
| 3 | sponsors/mksglu | TypeScript | (masked/sign-in) | Context window optimization for AI coding agents; sandboxes tool output (98% reduction). | NEW — Wildcard candidate |
| 4 | K-Dense-AI/scientific-agent-skills | Python | (masked/sign-in) | Turn any AI agent into an AI Scientist; '#1 Agent Skills library for science'. | Wildcard / Emerging |
| 5 | HKUDS/CLI-Anything | Python | (masked/sign-in) | Make ALL software Agent-Native — bind any CLI to agents via CLI-Hub. | Wildcard / Emerging |
| 6 | ifixai-ai/iFixAi | Python | (masked/sign-in) | Independent Auditing of AI Agents; run by human or the agent itself. | AI Security |
| 7 | vxcontrol/pentagi | Go | (masked/sign-in) | Fully autonomous AI Agents system for complex penetration testing. | CyberSecurity |
| 8 | nvim-sh/nvm | Shell | (masked/sign-in) | Node Version Manager — POSIX bash script to manage Node.js versions. | — |
| 9 | rust-lang/rust | Rust | (masked/sign-in) | Empowering everyone to build reliable and efficient software. | — |
| 10 | xtool-org/xtool | Swift | (masked/sign-in) | Cross-platform Xcode replacement; SwiftPM builds on Linux/Windows/macOS. | Wildcard / Emerging |
| 11 | sponsors/ntdevlabs | C# | (masked/sign-in) | WinUI app for building smaller, customized Windows 11 images. | — |
| 12 | NationalSecurityAgency/ghidra | Java | (masked/sign-in) | Ghidra — software reverse engineering (SRE) framework. | — |
High-throughput, memory-efficient LLM inference & serving engine; Blackwell/AMD/TPU backends, structured decoding, MoE scheduling.
Serve DeepSeek/Qwen/GLM-class models at scale; the self-hosted GenAI serving reference.
High-performance serving + RL (RLHF/GRPO) for LLMs & multimodal; radix-attention, structured output, DeepSeek support.
Low-latency serving and RL workloads on the same runtime; v0.5.21.
Kimi's serving platform (Moonshot AI): disaggregated prefill/decode over RDMA, focused on long-context & RL.
Reference for KVCache disaggregated inference at Moonshot scale.
GPU cluster manager for high-performance AI serving (vLLM/SGLang) with on-demand SSH GPU instances.
Pool GPUs and serve vLLM/SGLang across a homelab or small cluster; v2.2.3.
Our agent harness: MCP-first, persistent cron, skills, memory. v0.22.0 (2026-10-14) — new release today.
Runs this briefing. Update to v0.22.0 (CVE-2026-14625 line fully behind us).
Supercharge AI agents with web data: crawling, scraping, search, Markdown extraction; cloud + self-host.
Powers agent research; 100+ commit/week velocity, v2.11.0.
Makes AI agents think like the lazy senior dev; YAGNI-oriented agent-skills/prompt rules.
Trim agent over-engineering; JS skill packs.
Pre-built specialist agents (frontend, Reddit, whimsy) as a turnkey 'AI agency' in your shell.
Drop-in multi-agent workflows with packaged personalities.
Collaborative workspace to build agentic workflows & RAG across models; deploy on VPC or self-hosted.
Prod-grade agent app builder with MCP/skills; 1.17.1.
Build your own network of agents from Claude Code, Codex and other coding CLIs in one controlled loop.
Orchestrate multiple coding CLIs as one system; v0.6.10 (10-12).
Run Kimi, GLM, MiniMax, DeepSeek, gpt-oss, Qwen, Gemma locally. v0.40.4 (10-12).
Self-hosted inference for HHome / edge AI.
User-friendly self-hosted AI interface (Ollama, OpenAI API, MCP, RAG); v0.12.1 released 10-14.
Polished private chat/RAG UI over local models.
Open-source AI coding assistant for VS Code: completion, chat, edits, reviews with local or hosted models.
Private code completion/editing; your models your infra; v4.0.20.
~95% SimpleQA local deep research; all local & cloud LLMs (llama.cpp, Ollama), 10+ search engines, encrypted.
Private agentic deep research without cloud; v1.10.7.
Fully autonomous AI agents for complex penetration testing; Go; v2.2.0 (10-05).
AI-driven pentest automation on authorised, isolated ranges.
Open-source AI-powered offensive-security harness for automated penetration testing; v1.1.16.
AI-assist pentesting workflows; authorised engagements.
AI-powered pentesting framework (Rust) automating offensive security ops; v4.2.4 (10-04).
Augment pentesting automation; isolated authorized ranges.
Personal red-teamer & CTF notes: offensive/defensive handbooks consolidated into a reference repo.
Reference for red-team & blue-team techniques.
Test prompts, agents, RAGs; red-teaming/vuln scanning for AI; declarative configs, CI/CD. Used by OpenAI & Anthropic (README claim).
Continuous LLM eval & adversarial testing in CI.
Independent auditing of AI agents — run by human or the agent itself to answer crucial safety questions; v4.1.0.
Audit your own agent behavior for safety/trust.
The LLM vulnerability scanner; v0.17.0 — red-team probes for hallucination, prompt injection, data leak.
Probe local/served LLMs for failure modes; standard tool.
Coding-agent skill for multi-phase security audits: recon, coverage-led hunting, adversarial validation.
Drop into Claude Code/Codex to audit a codebase; 29k★.
Lightweight multi-language static analysis; pattern-based find-bug-variant scanner; v1.180.0.
SAST in CI + custom org rules; 30+ languages.
Static analysis for insecure patterns in Android/iOS source (Java, Kotlin, Swift, Obj-C); powered by Semgrep & libsast.
Mobile SAST scanning; v1.0.1 (09-21).
Collection of Semgrep rules from vulnerability research; v2.0.0.
Reusable find-bug-variant patterns for research.
Open-source security platform: unified XDR & SIEM for endpoints & cloud workloads; v4.14.8 (09-25).
Self-hosted SIEM/XDR for estate; stay on 4.14.x (5.0 still beta).
Main Sigma rule repository: generic SIEM detection rules (Splunk, Elastic, others); r2026-07-01.
Source of detection content for hayabusa + SIEM.
Sigma-based threat hunting & fast forensics timeline generator for Windows event logs; v4.2.0 (10-13).
Fast EVTX triage across many hosts in IR.
Rapidly search & hunt through Windows forensic artefacts (Sigma); v2.17.1 (10-14).
Fast threat hunting over EVTX corpora.
Proxmox VE Helper-Scripts: one-line LXC/VM install scripts; 2026-10-13 tag (auto-released 10-14).
Runs our Homelab (LXC205 etc.).
Open-source home automation; 2026.10.1 (10-10).
Our HHome automation backbone.
NVR with realtime local object detection for IP cameras; v0.18.1 (10-13).
Local, private camera NVR + detection.
Official Xiaomi Home integration for Home Assistant; v0.5.0 (09-28).
Native Xiaomi device control in HA.
Reverse engineer anything with agents — from app behavior down to native binaries; rea-agents-6.5.0 (10-14, today).
Agent-driven reverse engineering/RE workflows.
Fully-local ElevenLabs alternative: voice cloning, design, dubbing, dictation, transcription in 646 languages (AGPL-3.0); v0.5.6.
Local, private voice production stack.
Make ALL software agent-native: bind any CLI to agents via CLI-Hub; v0.4.0.
Expose arbitrary CLIs as agent tools.
Turn any AI agent into an AI Scientist; the '#1 Agent Skills library for science', claims 250,000+ scientists; v2.72.0.
Add scientific research skills to agents.
Cross-platform Xcode replacement; build & deploy iOS apps with SwiftPM on Linux, Windows, macOS; 1.22.2 (10-14, today).
Non-macOS iOS builds; high-velocity Swift work.
| Repo | Category | ★ | Δ24h | Commits 7d | PRs merged | Contributors | Latest release | Risk |
|---|---|---|---|---|---|---|---|---|
| vllm-project/vllm | AI & LLM Architectures | 93,793 | n/a | 100+ | n/a | n/a | v0.31.0 (10-05) | Low |
| sgl-project/sglang | AI & LLM Architectures | 37,141 | n/a | 100+ | n/a | n/a | v0.5.21 (10-02) | Low |
| ollama/ollama | Hermes / Local | 183,163 | n/a | 54 | n/a | n/a | v0.40.4 (10-12) | Low |
| open-webui/open-webui | Hermes / Local | 155,676 | n/a | 100+ | n/a | n/a | v0.12.1 (10-14) | Low |
| firecrawl/firecrawl | Agentic AI | 191,536 | n/a | 52 | n/a | n/a | v2.11.0 (06-19) | Low |
| langgenius/dify | Agentic AI | 158,473 | n/a | 100+ | n/a | n/a | 1.17.1 (09-10) | Low |
| home-assistant/core | Smart Home | 91,496 | n/a | 100+ | n/a | n/a | 2026.10.1 (10-10) | Low |
| community-scripts/ProxmoxVE | Smart Home | 29,816 | n/a | 100+ | n/a | n/a | 2026-10-13 (10-14) | Low |
| wazuh/wazuh | SIEM | 17,255 | n/a | 100+ | n/a | n/a | v4.14.8 (09-25) | Low |
| NousResearch/hermes-agent | Agentic AI | 253,755 | n/a | 100+ | n/a | n/a | v0.22.0 (10-14) | Low |
Δ24h, PRs and contributor counts are marked n/a this run where not individually fetched; weekly commit counts are 7-day deltas (cap 100/page). Click through to GitHub Insights for live figures.