[Blog](https://excessionlabs.ai/blog/) · 1 November 2026 · Updated 3 November 2026 · [Excession Labs](https://excessionlabs.ai/about/)

# Introducing Incursion

Source page: https://excessionlabs.ai/blog/introducing-excession/

Incursion by Excession Labs is an AI agent for offensive security that runs in your terminal. A planner splits the job, workers run it in parallel, and every finding comes back with proof.

On this page: [What it is](#what) · [How it works](#how) · [Models](#models) · [How to start](#start) · [Scripts and CI](#ci) · [The API](#api)

## What it is

Incursion is a terminal workspace for authorized security work: reconnaissance, web and API testing, code audit, exploit development, reverse engineering and malware analysis. It is its own harness: it runs the agent loop, the tools, the planner, the workers, the task graph and the session history.

It is for pentesters, red teams, bug bounty hunters and security engineers who work from a terminal. It does in-scope work without refusing it. The [Acceptable Use Policy](https://excessionlabs.ai/aup/) sets the scope: you test only systems that you own or have written permission to test.

## How it works

- You give a goal, and a planner breaks it into assignments, which are tasks in a task graph.
- Workers run the assignments in parallel, 12 at most by default. Open `/agents` to see each assignment and its latest action. Set the limit with `/agents 8`, or with `-` and `+` in that view. Press `p` there to pause or resume the selected assignment. The composer stays open while work runs.
- Each command, file write and network call can run on its own, be blocked, or wait for your approval. You set the rules with `excession rules`. Tools run with your full user access, so set a rule for anything you want blocked or held for approval.
- Each finding has a severity, a status, the target and source line, a summary, the evidence, steps to reproduce and a fix. You can retest a finding in a fresh session. `/results` lists the findings with severity and status, and `/report` writes a Markdown findings report, `report.md`.

Incursion works with the tools you already use: MCP servers, skills, `AGENTS.md` project instructions, custom slash commands and hooks. Long sessions compact their own context. You can save, resume, fork and export sessions.

## Models

Run `/model` to choose one of two models. Both run through your Excession account and use your plan credit and balance. You do not need separate provider API keys.

- DeepSeek V4.1 Flash, `deepseek/deepseek-v4.1-flash-1017` (the default)
- DeepSeek V4.1 Flash Abliterated, `deepseek-v4.1-flash-abliterated`

Kimi K3.1 Pro, GLM 5.5 and GLM 5.3 are coming soon. [Prices per model](https://excessionlabs.ai/api#models) are on the API page. `/effort` sets the reasoning level. The default is high.

## How to start

1. Install Incursion. On macOS and Linux:

```
curl -fsSL https://excessionlabs.ai/install.sh | sh
```

On Windows (PowerShell):

```
irm https://excessionlabs.ai/install.ps1 | iex
```

2. Sign in by running `excession` or `excession login`. The terminal shows a code and opens the browser. Check that the codes match, then approve. There is no access request and no review.
3. Use the $5 API credit included once with every new account. No card required. When you need more, add funds from $0.50 or pick a plan in [Billing](https://excessionlabs.ai/app/billing). See [how pricing works](https://excessionlabs.ai/blog/simple-pricing/).
4. Open your project and give a concrete first request:

```
excession whoami
excession -C /path/to/your/project
```

```
Review this repository's authentication flow. Explain confirmed issues with file
references and reproduction steps, then propose fixes and regression tests.
```

## Scripts and CI

Headless mode runs without the interface. With `--json`, stdout is a JSONL event stream and the exit code reports the result.

```
excession exec 'Review this repository and verify confirmed findings.' --json
git diff | excession exec 'review this'
```

## The API

The Excession API serves the same models. The base URL is `https://api.excessionlabs.ai/v1`. It accepts OpenAI Chat Completions, OpenAI Responses and Anthropic Messages, with streaming and tool calls. The limit is 600 requests per minute per key. The CLI and your API keys use the same account, plan credit and balance. Details are on the [API page](https://excessionlabs.ai/api) and in the [API docs](https://excessionlabs.ai/docs/#api).

[Get started](https://excessionlabs.ai/login?next=/app) [Read the docs](https://excessionlabs.ai/docs/)

## Continue reading

- [DeepSeek streaming latency: measured sample and raw results](https://excessionlabs.ai/blog/deepseek-api-latency-sample/)
- [DeepSeek API integration: Python, streaming and tool calls](https://excessionlabs.ai/blog/deepseek-api-guide/)
- [How plan credit and balance work](https://excessionlabs.ai/blog/simple-pricing/)
- [DeepSeek API: models, prices and quickstart](https://excessionlabs.ai/api)
- [Excession Labs documentation](https://excessionlabs.ai/docs/)