Do OpenTrojan AI agents auto-execute or auto-publish?

No. Every agent output is a draft flagged with requiresReview = true. Nothing is executed on systems or published without human review and approval.

Who reviews AI agent outputs?

A set of human-in-the-loop governance roles — analyst, researcher, reviewer, security lead and admin — verify evidence, citations and confidence before any output is used.

AI Agents

Three AI agents assist security teams by producing cited, confidence-labelled draft outputs. Every agent honours human-in-the-loop: outputs require review before use.

Human-in-the-loop

All AI Agent outputs are drafts that flag requiresReview = true. Nothing is auto-executed or auto-published without human review and approval.

AnalystDrafts and refines AI-generated analysis drafts.
ResearcherVerifies evidence, citations and source provenance.
ReviewerReviews AI output against quality and confidence standards.
Security LeadApproves findings before operational use.
AdminOversees agent tooling, permissions and governance policy.

Threat Analyst threat_analyst

Investigates entities, summarizes campaigns and correlates CVEs.

Capabilities: Campaign summarization · CVE correlation · Indicator investigation

Tasks: summarize_campaign, correlate_cve, investigate_entity

Sample output

threat_analyst: sample summarize_campaign draft (2 evidence)

Confidence 70% · requiresReview: true

Citation: NVD confidence 95%
Citation: CISA KEV confidence 90%

Research Agent research

Collects sources, compares claims and drafts research reports.

Capabilities: Source collection · Claim comparison · Report drafting

Tasks: compare_claims, draft_research

Sample output

research: sample compare_claims draft (2 evidence)

Confidence 70% · requiresReview: true

Citation: NVD confidence 95%
Citation: CISA KEV confidence 90%

Enterprise Analyst enterprise_analyst

Produces risk summaries, asset impact and executive briefs.

Capabilities: Risk summary · Asset impact mapping · Executive briefing

Tasks: risk_summary, executive_brief

Sample output

enterprise_analyst: sample risk_summary draft (2 evidence)

Confidence 70% · requiresReview: true

Citation: NVD confidence 95%
Citation: CISA KEV confidence 90%

Agent Operation Center

Phase 18 analysts: threat_intelligence · research · enterprise. Every run is a review-flagged draft.

threat_intelligence pending quality 84 · conf 70%

Investigate finance ransomware campaign — Sources: CISA KEV · Vendor Advisory
research approved quality 80 · conf 62%

Validate Log4Shell exploitation claims — Sources: Research Paper
enterprise pending quality 88 · conf 73%

Executive Q3 posture briefing — Sources: Risk Context