{"slug": "agenthound-offensive-security-framework-for-ai-agent-infrastructure", "title": "Agenthound – Offensive security framework for AI agent infrastructure", "summary": "AgentHound, an open-source offensive security framework for AI agent infrastructure, has been released. The tool performs recon, fingerprinting, credential looting, model inversion, and persistence across the agentic stack, merging findings into a Neo4j graph to prove attack paths. It covers 12 agent clients, MCP, A2A, model gateways, inference servers, vector stores, MLOps, and notebooks.", "body_md": "**MCP · A2A · model gateways · inference servers · vector stores · MLOps · notebooks · 12 agent clients**\n\n[Quickstart](#-quick-start) ·\n[Capabilities](#-capabilities) ·\n[Lifecycle](#-the-offensive-lifecycle) ·\n[Graph Model](https://docs.agenthound.io/reference/graph-model/) ·\n[Docs](https://docs.agenthound.io) ·\n[Safety](#-safety--authorization)\n\nAuthorized use only.AgentHound ships read-only discoveryandactive exploitation modules. Run it only against infrastructure you own or are written-authorized to assess. See[Safety & Authorization].\n\n**AgentHound is an open-source offensive security framework for AI agent infrastructure.** It runs the full engagement - recon, fingerprinting, credential looting, **modelfile / system-prompt / fine-tune inventory**, model inversion, tool and instruction poisoning, and config-implant persistence - across every layer of the modern agentic stack, then merges every fact into one Neo4j graph and proves the attack paths that tie it all together. Agenthound is BloodHound for the agentic stack.\n\n|\n🌐 |\n🔓 |\n|\n🧬 |\n🔬 |\n|\n☠️ |\n🗄️ |\n|\n🕸️ |\n🧪 |\n|\n📊 |\n🧩 |\n\n| Surface | Discovery & inventory | Validation / active operations |\n|---|---|---|\nAgent clients |\n12 MCP client config formats plus instruction files (`CLAUDE.md` , `AGENTS.md` , `.cursorrules` ) |\nInstruction poisoning and reversible malicious-server config implants |\nMCP |\nStdio and HTTP/SSE servers, tools, resources, prompts, and authentication | Credential-reach verification; ContextForge tool-description poisoning and round-trip validation |\nA2A |\nAgent cards, JWS verification, skills, delegation, and authentication | Cross-protocol and delegation-path analysis |\nLiteLLM |\nOperator-supplied master-key record, masked provider references, and hashed virtual-key metadata with spend context | Cross-service credential correlation and path analysis |\nOllama / vLLM |\nOllama model metadata, stable modelfile hashes, system-prompt presence, and fine-tune signals; vLLM fingerprinting | Optional raw modelfile, template, and system-prompt capture; local GGUF extraction |\nQdrant |\nCollections, point counts, and optional bounded payload samples | Read-only exposure analysis |\nMLflow |\nExperiments, runs, registered models, artifact/storage URIs, and verified anonymous-exposure evidence | Read-only exposure analysis |\nJupyter |\nSessions and bounded notebook trees | Read-only anonymous-versus-authenticated exposure analysis |\nOpen WebUI / LangServe |\nOpen WebUI authentication posture plus authenticated upstream/RAG credential inventory and observed exposure evidence; LangServe fingerprinting | Read-only credential inventory and exposure evidence |\n\n**8 lifecycle CLI commands**-`scan`\n\n·`discover`\n\n·`loot`\n\n·`extract`\n\n·`poison`\n\n·`implant`\n\n·`revert`\n\n·`campaign`\n\n(`enumerate`\n\n+`fingerprint`\n\nrun inside`scan`\n\n)**8 fingerprinters · 6 looters · 1 model-inversion extractor · 2 poisoners · 1 implanter****Graph:** 23 node labels · 32 edge kinds (20 raw + 12 composite) ·**15 post-processors****Intelligence:** 35 text-detection rules + 7 YAML fingerprint rules + 1 code-backed Jupyter detector · 19 prebuilt attack-path queries · OWASP MCP Top 10 + OWASP Agentic Top 10 + MITRE ATLAS mappings**One static collector binary with no DB/UI/server dependencies.** Config-only discovery can run offline. Apache-2.0 releases include a Cosign-signed checksum manifest and per-archive SPDX SBOMs.\n\nDefault path prerequisites: Docker + Compose v2. No Go, no Node, no\n`git clone`\n\n.\n\n**1. Start the analysis server** - Neo4j + Postgres + UI, binds\n`127.0.0.1:8080`\n\n:\n\n```\ncurl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/docker/docker-compose.public.yml | docker compose -f - -p agenthound up -d --wait\n```\n\n**2. Install the collector** - single static binary → `~/.local/bin`\n\n:\n\n```\ncurl -sSfL https://raw.githubusercontent.com/adithyan-ak/agenthound/main/install.sh | sh\nexport PATH=\"$HOME/.local/bin:$PATH\"\n```\n\nOr choose one of these package-manager alternatives:\n\n```\n# Homebrew (macOS or Linux; adds the tap automatically)\nbrew install adithyan-ak/agenthound/agenthound\n\n# Go 1.25.12+\ngo install github.com/adithyan-ak/agenthound/collector/cmd/agenthound@1.0.0\n```\n\nGo installs into `GOBIN`\n\nor, by default, `$(go env GOPATH)/bin`\n\n; ensure that\ndirectory is on `PATH`\n\n.\n\n**3. Scan local configs** - offline, read-only, raw credential values omitted.\nChoose one coverage level and ingest the saved artifact.\n\nNormal scan — recommended first run:\n\n```\nagenthound scan --config --ingest http://127.0.0.1:8080\n```\n\nDeep scan — adds bounded nested-project instruction discovery:\n\n```\nagenthound scan --config --deep --ingest http://127.0.0.1:8080\n```\n\nBoth commands check registered instruction sources at your home and selected\nproject roots. Add `--project-dir /path/to/project`\n\nwhen the target is not the\ncurrent directory. Deep discovery keeps that selected project independently\ncovered even inside a normally pruned home subtree.\n\nThe collector saves `./scan-<scan_id>.json`\n\nbefore upload, then prints a compact\ningest receipt. Use `--json`\n\nfor the full receipt.\n\n**4. Open the graph at\nhttp://127.0.0.1:8080.**\n\nThe standalone server binary is also available as\n`adithyan-ak/agenthound/agenthound-server`\n\nthrough Homebrew. Both binaries are\navailable from release archives, or from Go at the explicit\n`@1.0.0`\n\nrevision. Release archives include a Cosign-signed checksum manifest\nand per-archive SPDX SBOMs - see the\n[installation guide](https://docs.agenthound.io/getting-started/install/).\n\nCollection commands write ingest-ready JSON. The quickstart above shows the ingest pattern once.\n\n**1. Recon** - find the AI estate:\n\nScan common AI-service ports and fingerprint what responds:\n\n```\nagenthound scan 10.0.0.0/24\n```\n\nProbe likely web ports for MCP and A2A protocol shapes:\n\n```\nagenthound discover 10.0.0.0/24\n```\n\n**2. Loot** - inventory credential evidence and model metadata:\n\nWith `LITELLM_MASTER_KEY`\n\nset, inventory LiteLLM credential references and\nspend metadata:\n\n```\nagenthound loot 10.0.0.20:4000 --type litellm \\\n  --master-key \"$LITELLM_MASTER_KEY\"\n```\n\nOpt in to raw Ollama modelfiles, templates, and system prompts:\n\n```\nagenthound loot 10.0.0.10:11434 --type ollama \\\n  --include-credential-values\n```\n\nLooter types: `litellm`\n\n, `ollama`\n\n, `openwebui`\n\n, `mlflow`\n\n, `qdrant`\n\n, `jupyter`\n\n.\n\n**3. Extract** - with `AI_MODEL_ID`\n\nset to an AIModel ID from the graph, invert\na locally-available GGUF weight file to recover fine-tune residue:\n\n```\nagenthound extract \"$AI_MODEL_ID\" --type embedding-invert \\\n  --artifact /path/to/model.gguf --commit --engagement-id ENG-1\n```\n\n**4. Validate, exploit, persist + revert** - run sanctioned, reversible\noffensive actions:\n\nWith ContextForge authentication configured, run a reversible poison-and-restore round trip against a managed MCP tool:\n\n```\nagenthound campaign \\\n  https://gateway.example/servers/0123456789abcdef0123456789abcdef/mcp \\\n  --scenario mcp-poison-roundtrip --adapter contextforge \\\n  --target-id support-lookup --engagement-id ENG-ROUNDTRIP --commit\n```\n\nCommit a targeted tool-description poison:\n\n```\nagenthound poison \\\n  https://gateway.example/servers/0123456789abcdef0123456789abcdef/mcp \\\n  --type mcp.tool.description --adapter contextforge \\\n  --target-id support-lookup --inject-file payload.txt \\\n  --commit --engagement-id ENG-1\n```\n\nImplant a malicious MCP server entry, then roll the engagement back:\n\n```\nagenthound implant localhost --type mcp.config.malicious-server \\\n  --file \"$HOME/.cursor/mcp.json\" --inject-file server-entry.json \\\n  --commit --engagement-id ENG-1\n\nagenthound revert ENG-1\n```\n\n**5. Analyze** - pathfind and review:\n\n```\ncurl -sSf http://127.0.0.1:8080/api/v1/analysis/prebuilt/credential-chain\ncurl -sSf 'http://127.0.0.1:8080/api/v1/analysis/findings?severity=critical'\n```\n\nSee the full [CLI reference](https://docs.agenthound.io/reference/cli/) for\nevery verb, flag, and module.\n\nAgentHound's findings are built around the questions red teams and defenders ask when they need to understand reachability, blast radius, and pathing risk.\n\n| Finding | What it means | Question it answers |\n|---|---|---|\nCredential-chain paths |\nThe same secret appears in multiple contexts, letting trust cross service boundaries. | Which reused credential gives an agent access it never explicitly had? |\nReachability |\nAgents, MCP servers, tools, resources, prompts, A2A skills, and AI services are joined into one graph. | What can this agent actually reach if trust edges are followed? |\nExecution paths |\nAn agent can reach shell-like, database, network, or other high-impact tools. | Which agents have a path to command execution, data-plane control, or production impact? |\nExfiltration paths |\nAn agent can read sensitive data and also reach an outbound channel. | Where can sensitive data leave the environment? |\nCross-protocol pivots |\nMCP, A2A, host context, and AI-service infrastructure combine into one reachable path. | Can one agent protocol become a bridge into another trust domain? |\nTool poisoning |\nTool descriptions, prompts, or instruction files contain suspicious model-steering content. | Which tools or instructions could influence model behavior in unsafe ways? |\nTool shadowing |\nA lookalike tool mimics a trusted capability or name. | Which tool could intercept or hijack an expected action? |\nRug pulls |\nA tool's description, schema, or server instructions changed between scans. | What changed since the last known-good graph, and did it create a new risk path? |\nUnauthenticated servers or agents |\nMCP servers or A2A protocol handlers affirmatively accepted a credential-free probe; A2A uses a bounded read-only nonexistent-task lookup and never submits a message. | Which exposed agent surfaces need immediate review? |\nRisk hotspots |\nNodes and paths are prioritized with risk scores and prebuilt graph queries. | Where should investigation or remediation start first? |\n\nSee [Detection Rules](https://docs.agenthound.io/reference/detection-rules/) and [Risk Scoring](https://docs.agenthound.io/reference/risk-scoring/) for the full catalog.\n\nAgentHound doesn't just list findings - it creates graph edges you can chain, query, and report:\n\n: an agent can traverse trust, credential, host, or protocol relationships to reach a target.`CAN_REACH`\n\n: an agent can reach a tool capable of command, database, network, or code execution.`CAN_EXECUTE`\n\n: an agent can read sensitive data and send it through an outbound channel.`CAN_EXFILTRATE_VIA`\n\n: an A2A agent can act as another A2A agent.`CAN_IMPERSONATE`\n\n: a tool mimics a trusted tool closely enough to hijack expected behavior.`SHADOWS`\n\n: tool or instruction text contains model-steering content.`POISONED_DESCRIPTION`\n\n/`POISONED_INSTRUCTIONS`\n\nThese edges turn AI-agent infrastructure into something you can pathfind instead of manually reason about.\n\n```\nflowchart LR\n  Agent[\"AgentInstance<br/>claude-desktop\"]\n  Notes[\"MCPServer<br/>internal-notes\"]\n  Identity[\"Identity<br/>configured auth\"]\n  ConfigCred[\"Credential<br/>configured secret<br/>value_hash: a3f9...\"]\n  Gateway[\"LiteLLMGateway<br/>prod\"]\n  MasterCred[\"Credential<br/>gateway master key<br/>value_hash: a3f9...\"]\n  ProviderRef[\"Credential<br/>masked provider reference<br/>material not observed\"]\n\n  Agent -- TRUSTS_SERVER --> Notes\n  Notes -- AUTHENTICATES_WITH --> Identity\n  Identity -- USES_CREDENTIAL --> ConfigCred\n  ConfigCred -. \"same value_hash<br/>correlation evidence, not a stored edge\" .-> MasterCred\n  Gateway -- EXPOSES_CREDENTIAL --> MasterCred\n  Gateway -- EXPOSES_CREDENTIAL --> ProviderRef\n  Agent -- \"CAN_REACH<br/>(derived)\" --> ProviderRef\n```\n\nNo single config file declares this path. AgentHound hashes the supplied\nLiteLLM master key, correlates it with the matching client-config credential by\n`value_hash`\n\n, and computes the derived reachability edge once both outputs land\nin the same graph. The dotted correlation is explanatory, not a stored\nrelationship. The provider target remains a reference-only finding: it does not\nassert that AgentHound obtained usable upstream provider secret material.\n\nBuilt to be run under authorization, with the controls this audience checks for:\n\n**Read-only looter contract**- GET/HEAD by default, with documented lookup/search POSTs for APIs that expose no read equivalent and an opt-in Ollama embeddings compute POST via`--include-embeddings`\n\n; each looter is guarded by a`get_only_test.go`\n\nregression test.**Mutating verbs dry-run by default**-`poison`\n\n,`implant`\n\n, and mutation campaigns do not modify a target without`--commit`\n\n.`extract`\n\nperforms its local analysis in dry-run and uses`--commit`\n\nonly to emit ingest data.**Compile-time-mandatory recovery path**-`Poisoner`\n\n/`Implanter`\n\nembed`Reverter`\n\n; every destructive module must implement recovery. Runtime restoration is verified, not guaranteed across provider policy changes, conflicts, or unavailable targets.**Receipt before mutation**- the undo receipt is persisted to disk*before*the write lands.**AUTHORIZED gates +**- interactive first-run prompts for looting and offensive actions. IDs are required for`--engagement-id`\n\n`extract`\n\n,`poison`\n\n,`implant`\n\n, and`campaign`\n\n, optional for`loot`\n\n, and recorded on the evidence or receipts those commands emit.**Recon guardrails**- public-IP targets require`--allow-public-targets`\n\nplus interactive`AUTHORIZED`\n\n;`--authorization-file`\n\noptionally records a path + SHA-256 watermark. Link-local and multicast targets are refused, except for the explicit cloud-metadata address`169.254.169.254`\n\n.\n\n**It is explicitly not** a C2, a stealth/evasion implant, or a multi-user SaaS. It is transparent, single-user authorized-assessment tooling, and the design says so.\n\nRead the [security posture guide](https://docs.agenthound.io/operator/security/) and [offensive actions guide](https://docs.agenthound.io/operator/offensive-actions/).\n\n[Quickstart](https://docs.agenthound.io/getting-started/quickstart/) · [CLI](https://docs.agenthound.io/reference/cli/) · [Graph Model](https://docs.agenthound.io/reference/graph-model/) · [Detection Rules](https://docs.agenthound.io/reference/detection-rules/) · [Security](https://docs.agenthound.io/operator/security/)\n\nWrite your own attack: implement an action interface, drop a `register.go`\n\n, blank-import it - see [CONTRIBUTING.md](/adithyan-ak/AgentHound/blob/main/CONTRIBUTING.md) and the [module authoring guide](https://docs.agenthound.io/contributing/modules/). Found a vulnerability in AgentHound itself? See [SECURITY.md](/adithyan-ak/AgentHound/blob/main/SECURITY.md).\n\nAgentHound is licensed under the [Apache License 2.0](/adithyan-ak/AgentHound/blob/main/LICENSE).", "url": "https://wpnews.pro/news/agenthound-offensive-security-framework-for-ai-agent-infrastructure", "canonical_source": "https://github.com/adithyan-ak/agenthound", "published_at": "2026-07-28 23:22:15+00:00", "updated_at": "2026-07-28 23:52:58.497180+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-agents", "ai-tools", "ai-research"], "entities": ["AgentHound", "Neo4j", "MCP", "A2A", "LiteLLM", "Ollama", "vLLM", "Qdrant"], "alternates": {"html": "https://wpnews.pro/news/agenthound-offensive-security-framework-for-ai-agent-infrastructure", "markdown": "https://wpnews.pro/news/agenthound-offensive-security-framework-for-ai-agent-infrastructure.md", "text": "https://wpnews.pro/news/agenthound-offensive-security-framework-for-ai-agent-infrastructure.txt", "jsonld": "https://wpnews.pro/news/agenthound-offensive-security-framework-for-ai-agent-infrastructure.jsonld"}}