--- title: Introducing Joro: Using AI to Build Security Tooling description: Bishop Fox introduces Joro, an open-source web exploitation framework built almost entirely using AI coding assistance, featuring an intercepting proxy,... canonical: https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Joro: Using AI to Build Security Tooling | daily.dev og:description: Bishop Fox introduces Joro, an open-source web exploitation framework built almost entirely using AI coding assistance, featuring an intercepting proxy,... og:url: https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l og:image: https://api.daily.dev/og/posts/VbCCPPD3l.png og:image:alt: Introducing Joro: Using AI to Build Security Tooling og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Joro: Using AI to Build Security Tooling **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 6 min read · 0 upvotes · 0 comments ## Summary Bishop Fox introduces Joro, an open-source web exploitation framework built almost entirely using AI coding assistance, featuring an intercepting proxy, out-of-band callback support, authenticated web shell generation, C2 integration (including Sliver), and team collaboration in a single binary with embedded web UI. The author, a self-taught Go developer with little frontend experience, recounts how AI rapidly scaffolded the Go/TypeScript application but required constant human oversight, citing an example where the model hallucinated protobuf field numbers when integrating with Sliver's gRPC interface, causing RPC errors that required manual debugging before the AI could fix its own mistake. The piece concludes that AI is a powerful force multiplier for building complex offensive security tooling, but a human in the loop remains essential for anything semi-complex. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Joro and what features does it include for web exploitation testing? Joro is an open-source collaborative web exploitation framework for offensive security professionals, built by Bishop Fox. It includes an intercepting proxy, out-of-band callbacks for blind vulnerability detection, authenticated web shell generation, and C2 integration including Sliver, packaged as a single binary with an embedded web UI and team collaboration features for both web application and internal network testing. _Developers exploring AI-assisted security tool development can track new frameworks like this one on daily.dev._ ### What kind of mistakes does AI make when generating gRPC and protobuf integration code? AI can hallucinate field numbers in protobuf messages that appear syntactically correct but do not match what the server actually expects, causing RPC errors. In one case building a Sliver C2 integration in Go, this caused connection failures that required manual debugging to identify, though the model was able to correct its own mistake once the issue was pinpointed and described back to it. _Engineers weighing how much to trust AI-generated integration code follow real debugging accounts like this on daily.dev._ ## Similar posts on daily.dev - [Apiiro Introduces AI Threat Modeling Built for the AI Coding Agent Era](https://daily.dev/posts/apiiro-introduces-ai-threat-modeling-built-for-the-ai-coding-agent-era-nd2zv76pp) · SD Times · 0 upvotes · 0 comments - [Building a web framework with AI while refusing to lower the bar on code quality](https://daily.dev/posts/building-a-web-framework-with-ai-while-refusing-to-lower-the-bar-on-code-quality-3naufdcsb) · ITNEXT · 7 upvotes · 0 comments - [Architecting a Rovo AI Teammate: From AI ‘Magic’ to Production-Ready Forge Code](https://daily.dev/posts/architecting-a-rovo-ai-teammate-from-ai-magic-to-production-ready-forge-code-3n6y1zdrt) · Atlassian · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#golang](https://daily.dev/tags/golang), [#ai-coding](https://daily.dev/tags/ai-coding), [#vibe-coding](https://daily.dev/tags/vibe-coding) [View this post on daily.dev](https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Joro: Using AI to Build Security Tooling","url":"https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l"},"datePublished":"2026-08-23T12:22:32.824Z","dateModified":"2026-08-23T12:45:47.554Z","description":"Bishop Fox introduces Joro, an open-source web exploitation framework built almost entirely using AI coding assistance, featuring an intercepting proxy,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7a3631c2b72ca1aafc5c86c13f4cdce9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7a3631c2b72ca1aafc5c86c13f4cdce9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,golang,ai-coding,vibe-coding","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Introducing Joro: Using AI to Build Security Tooling"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-joro-using-ai-to-build-security-tooling-vbccppd3l#faq","mainEntity":[{"@type":"Question","name":"What is Joro and what features does it include for web exploitation testing?","acceptedAnswer":{"@type":"Answer","text":"Joro is an open-source collaborative web exploitation framework for offensive security professionals, built by Bishop Fox. It includes an intercepting proxy, out-of-band callbacks for blind vulnerability detection, authenticated web shell generation, and C2 integration including Sliver, packaged as a single binary with an embedded web UI and team collaboration features for both web application and internal network testing. Developers exploring AI-assisted security tool development can track new frameworks like this one on daily.dev."}},{"@type":"Question","name":"What kind of mistakes does AI make when generating gRPC and protobuf integration code?","acceptedAnswer":{"@type":"Answer","text":"AI can hallucinate field numbers in protobuf messages that appear syntactically correct but do not match what the server actually expects, causing RPC errors. In one case building a Sliver C2 integration in Go, this caused connection failures that required manual debugging to identify, though the model was able to correct its own mistake once the issue was pinpointed and described back to it. Engineers weighing how much to trust AI-generated integration code follow real debugging accounts like this on daily.dev."}}]} ```