Decepticon: Autonomous Red Team Agent Integrates Claude and Codex

Key Takeaways

• Decepticon is an open-source autonomous red team agent that integrates AI reasoning with practical security testing.
• It supports AI models like Claude Code and OpenAI Codex, allowing operators to oversee assessments using familiar coding interfaces.
• The tool is designed to follow attack paths from reconnaissance to command and control within defined engagement rules.
• Initial benchmarks show a 98.08% success rate in a controlled lab environment, but these results are not independently verified for real-world enterprise networks.

Decepticon: AI-Powered Red Teaming Automation

Decepticon, an open-source project, introduces an autonomous red team agent that merges advanced AI reasoning capabilities with hands-on security testing methodologies. This innovative tool integrates with prominent AI models such as Claude Code and OpenAI Codex, enabling cybersecurity professionals to manage intricate security assessments directly from their preferred coding environments. Unlike conventional tools that merely scan for vulnerabilities and generate reports, Decepticon aims to simulate complete attack chains, meticulously adhering to predefined engagement parameters.

The project’s capabilities, as detailed in the Decepticon GitHub repository, encompass a wide spectrum of red team activities. These include comprehensive reconnaissance, exploitation of identified weaknesses, privilege escalation, lateral movement across compromised systems, and establishing command and control. While these represent the project’s ambitious claims, it is important to note that these features require validation in diverse, real-world network environments. Decepticon operates under an Apache 2.0 license, strictly requiring explicit written permission before any testing is conducted on live systems.

Technical Architecture and Agent Integration

Decepticon facilitates the connection of external coding agents through its proprietary Model Context Protocol (MCP). This protocol acts as a crucial bridge, empowering operators to monitor ongoing engagements, track progress, issue subsequent instructions, verify system states, and terminate active runs as needed. Significantly, the core red teaming operations are executed within Decepticon’s LangGraph server, rather than directly within the coding assistant itself.

To initiate operations, operators must register the MCP server post-runtime startup and then install an agent skill that outlines the intended workflow. The external agent guide highlights certain current limitations. For instance, its findings tool processes graph.json rather than comprehensive report files. Additionally, Docker users are advised to select their workspace via the interactive command-line interface before commencing an engagement.

This architecture capitalizes on the growing interest in specialized AI security agents, including subagents designed for penetration testing like Claude Code. However, Decepticon distinguishes itself by providing its own execution runtime, with its coding agent integration primarily serving as a control and monitoring interface. The project currently boasts 16 specialized agents, covering diverse domains such as discovery, exploitation, vulnerability research, Active Directory, cloud systems, smart contracts, and reverse engineering.

Each distinct objective is assigned a fresh context window, minimizing the influence of irrelevant historical data. Prior to any testing, Decepticon meticulously generates rules of engagement, an operational plan, and coordination documents, all meticulously mapped to the MITRE ATT&CK framework. Commands are executed within persistent tmux sessions inside a Kali Linux sandbox. An automatic prompt detection mechanism ensures agents can seamlessly interact with common interactive tools such as Metasploit, Sliver, and evil-winrm.

The system employs separate Docker networks to isolate management services from the sandbox and target environments. Neo4j is utilized to connect both networks, ensuring that findings are preserved across these boundaries. The standard deployment mandates Docker and Docker Compose v2, supporting macOS, Linux, and Windows platforms. Specialized services like BloodHound CE and Sliver are initiated on demand. For AI models, Decepticon offers flexibility, supporting Anthropic, OpenAI, Gemini, and local Ollama, with customizable profiles that assign different model tiers to specific tasks.

A Python package is also available as a client SDK, catering to custom tools and research workflows. It is crucial to understand that installing this SDK does not establish a standalone testing environment. Agents still rely on model and sandbox services over HTTP, either through the provided Docker stack or compatible services managed by the operator. This consideration is vital for effective deployment and integration planning.

Performance Benchmarks and Future Outlook

Developers report impressive results from the XBOW validation benchmark, with 102 successful challenges out of 104, equating to a 98.08% pass rate. This includes 45 easy, 50 medium, and seven hard challenges. The published benchmark evidence provides detailed challenge records and execution traces for independent review. It is important to note that these tests provided vulnerability category hints, which aided the agent in its search. Consequently, these results reflect performance within a specific lab setup and do not represent independently verified performance across complex enterprise networks.

Similar to other autonomous penetration testing initiatives like PentAGI, security teams are advised to thoroughly review all evidence and ensure that testing remains strictly within approved scopes. Decepticon’s roadmap includes a planned “Offensive Vaccine” loop, an ambitious development goal aimed at transforming security findings into defensive modifications and subsequent retesting, thereby creating a continuous improvement cycle.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.