Decepticon – Autonomous Red Team Agent that Integrates Claude and Codex

Decepticon is an open-source autonomous red team agent that connects AI reasoning with hands-on security testing. Its integration with Claude Code and OpenAI Codex lets operators manage assessments from familiar coding tools. Rather than simply scanning ports and writing reports, the project aims to follow attack paths within defined engagement rules.

The Decepticon GitHub repository describes support for reconnaissance, exploitation, privilege escalation, movement between systems, and command and control.

These are project claims, not proof that every feature works across real networks. The software is licensed under Apache 2.0 and requires explicit written permission before testing any system.

Decepticon AI Red Team Tool

Decepticon connects external coding agents through the Model Context Protocol, or MCP. This bridge lets an operator inspect engagements, watch progress, send follow-up instructions, check state, and stop active runs. The actual red team work runs inside Decepticon’s LangGraph server, rather than inside the coding assistant itself.

Operators register the MCP server after starting the runtime, then install an agent skill that explains the workflow. The external agent guide also notes current limits. Its findings tool reads graph.json rather than the full report files, and Docker users should select their workspace through the interactive CLI before starting an engagement.

The approach builds on interest in specialist AI security agents, including Claude Code penetration testing subagents. However, Decepticon provides its own execution runtime, while its coding agent integration acts mainly as a control and monitoring layer.

The project lists 16 specialist agents covering discovery, exploitation, vulnerability research, Active Directory, cloud systems, smart contracts, and reverse engineering.

Each objective gets a fresh context window to reduce unrelated history. Before testing, Decepticon generates rules of engagement, an operational plan, and coordination documents mapped to MITRE ATT&CK.

Commands run in persistent tmux sessions inside a Kali Linux sandbox. Automatic prompt detection helps agents continue working with interactive tools such as Metasploit, Sliver, and evil-winrm.

Separate Docker networks divide management services from the sandbox and test targets. Neo4j connects to both networks to preserve findings across that boundary.

The standard setup requires Docker and Docker Compose v2 and supports macOS, Linux, and Windows. Specialist services such as BloodHound CE and Sliver start on demand. Model options include Anthropic, OpenAI, Gemini, and local Ollama, with profiles that assign different model tiers to different tasks.

The Python package is also available as a client SDK for custom tools and research workflows. Installing it does not create a standalone testing environment. Agents still need model and sandbox services over HTTP, either through the supplied Docker stack or compatible services managed by the operator. This matters when planning deployments and integrations.

Developers report 102 successful challenges out of 104 in the XBOW validation benchmark, a 98.08% pass rate. Results include 45 easy, 50 medium, and seven hard challenges. The published benchmark evidence links challenge records and execution traces for review.

The tests supplied vulnerability category hints, which narrowed the agent’s search. These results therefore describe a specific lab setup, not independently verified performance across enterprise networks.

As with PentAGI’s autonomous penetration testing, teams should review evidence and keep testing within approved scope. Decepticon’s planned Offensive Vaccine loop would turn findings into defensive changes and retesting, but remains a stated development goal.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC