AI Agent OSINT Stack (2026)
7 days ago
Why Agents Are the Best OSINT Tool
gave claude code a name + email, said find everything. 20 mins: 3 unknown handles, 14 breach hits, forum alias under a different name. did nothing myself
OSINT is a pivot loop. find something → dig → find more → repeat. an agent just runs that automatically. web chatgpt can't execute anything, completely useless for this
Install Once
pip install holehe maigret
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot && pip install -r requirements.txt
then drop this into claude code / cursor agent:
bash access. target: [name] [email]
run holehe on the email. run maigret on any usernames found.
check https://leakcheck.io/api/public?check=[email]
pivot on every new handle or email. compile dossier.
The Tools
Holehe — hits 120+ platform password-reset endpoints. zero alert sent to target. proton hit = privacy-conscious. github hit = developer. teamtreehouse/codecademy = learning to code
Maigret — 3,000+ sites, parses actual page HTML not just HTTP codes, auto-pivots on new handles with
-P. found 3 handles in one run sherlock missed completelysherlock is fine for quick checks. problem: platforms return HTTP 200 on redirected
name.surname handles belonging to random people. agent reads actual page content. human copying raw output doxes the wrong personSpiderFoot — DNS history, WHOIS chains, paste sites, PGP keys, 200+ scanners. run it in footprint mode on an email and let it chain
theHarvester — emails + subdomains from a domain. good for professional targets
Breach Exposure
free, no key needed:
https://leakcheck.io/api/public?check=target@email.com
tells you exactly which databases had the email and what fields were exposed. 14 hits on one email: canva, deezer, minecraft server from 2019, gaming forums. the agent checks this automatically and adds it to the dossier
telegram bots front-end private elasticsearch clusters with Collection #1-5, Naz.API, infostealer logs (RedLine, Vidar). github tools contain zero breach data — they're just API wrappers that need paid keys to do anything
Avatar Pivot
when the target doesn't use their real name on steam or discord: download their profile avatar → run yandex reverse image search. same custom pfp on instagram + anonymous forum account under a different name. found a handle this way with zero other connection to the main identity
yandex destroys google lens for this. especially eastern europe, forum pics, non-celebrity faces