Decepticon: AI Agents for Hacking (Legally, Hopefully)
The Problem
Red teaming is tedious. Manual recon, planning attacks, executing them, and documenting results—it's all time-consuming and repetitive. Plus, when you’re simulating adversarial behavior, you’re limited by human creativity and speed. What if you could offload the grunt work to autonomous agents that handle it for you? That’s where Decepticon comes in.
What This Does
Decepticon is an "AI hacker"—a multi-agent red-teaming framework designed to simulate adversarial behavior autonomously. Think of it as a hive mind of bots that can handle the various stages of a cyberattack: reconnaissance, initial access, lateral movement, and more. The project is Python-heavy (82 files), with a frontend (frontend/streamlitapp.py) built on Streamlit. The backend lives in src/, which includes agent definitions (src/agents/swarm/), prompt engineering (src/prompts/), and utilities for managing AI models (src/utils/llm/).
The architecture is built around a "multi-agent system" where agents like Planner, Recon, and Summary (all in src/agents/swarm/) perform specific tasks and coordinate via shared states and workflows (frontend/web/core/workflowhandler.py). You can interact with this system either via CLI (frontend/cli/cli.py) or the web UI.
For deployment, there’s a Dockerfile.attacker and docker-compose.yml—so yes, you can run this in a containerized setup for better isolation. The project even supports both cloud-based and local AI models (src/utils/llm/configmanager.py), meaning you can roll your own "AI hacker" without an internet connection if you’re paranoid. Smart.
Real-World Use
Say you’re testing a company’s network security. You could configure mcpconfig.json to define attack settings, deploy the agents, and let them do their thing—recon, exploit, summarize findings, repeat. Then, you can use the replay feature (frontend/web/core/chatreplay.py) to walk through how the attack unfolded and share it with stakeholders. Or, export logs and submit them as part of a PR to the open-source community.
Here’s a quick snippet to spin up the agents via CLI:
python frontend/cli/cli.py --config mcpconfig.json
The agents will start coordinating tasks like scanning for vulnerabilities (src/tools/mcp/Reconnaissance.py) and attempting initial access (src/tools/mcp/Initial_Access.py).
The Bottom Line
Decepticon is ambitious—and let’s be real, a little terrifying. It’s not for casual users or folks looking for a quick vulnerability scan. But if you’re into offensive security or want to explore the bleeding edge of AI-driven red teaming, it’s worth your time. Just don’t forget the “don’t hack without permission” rule, or you’ll end up needing an actual lawyer, not a Python one.