Decepticon open-sources autonomous red-team agent, claims 98% on XBOW benchmark
Decepticon is an open-source autonomous red-team agent from PurpleAILAB, published on GitHub under Apache-2.0 and available either self-hosted via Docker or through the project's cloud demo. Its documentation says it coordinates 16 specialist agents by kill-chain phase — reconnaissance, exploitation, privilege escalation, lateral movement and C2 — running commands in a Kali Linux sandbox on a separate operational network, and it can be registered as an MCP server for Claude Code or Codex. The README self-reports a 102/104 (98.08%) pass rate on the XBOW validation-benchmarks and lists support for Anthropic, OpenAI, Google Gemini, MiniMax, DeepSeek, xAI, Mistral, OpenRouter, Nvidia NIM and local Ollama models, plus subscription logins such as Claude Max and ChatGPT Pro.
If those self-reported results reproduce, open-source autonomous attack agents are becoming reliable on medium-to-hard ranges, which could shift how both attackers and defenders automate security testing.