{"slug": "cyberstrike-drops-an-agpl-harness-for-ai-driven-red-teaming", "title": "CyberStrike drops an AGPL harness for AI-driven red-teaming", "summary": "CyberStrike released an AGPL-licensed open-source harness for AI-driven red-teaming, featuring a modular architecture with recon, attack graph generation, tool orchestration, evidence collection, and reporting phases. The tool supports pluggable LLM backends, YAML-based attack graph DSL, tool adapters for nmap, BloodHound, CrackMapExec, Impacket, and Metasploit, plus safety rails including scope enforcement and dry-run mode. It targets internal red-team exercises but lacks C2 framework integration and has noted LLM hallucination risks.", "body_md": "# CyberStrike drops an AGPL harness for AI-driven red-teaming\n\nWhat makes it different from the usual \"ask GPT for a payload\" scripts is the harness architecture. You don't just feed it a target and hope. The core loop runs: **recon → attack graph generation → tool orchestration → evidence collection → report**. Each phase is a pluggable module with a defined schema, so you can swap the LLM backend (local Llama-3-70B, [Claude](/en/tags/claude/), GPT-4o, whatever) without rewriting your exploit logic.\n\n**Key pieces worth knowing**\n\n**Attack graph DSL**— YAML-based, describes multi-step chains like \"enumerate SMB → extract hashes → pass-the-hash → dump LSASS\". The LLM expands high-level goals (\"get domain admin\") into concrete graphs at runtime.**Tool adapters**— First-class wrappers for nmap, bloodhound, crackmapexec, impacket, metasploit modules, and custom binaries. Adapters expose typed inputs/outputs so the planner can chain them reliably.**Memory layer**— SQLite-backed context store persists findings across runs. You can pause a campaign, switch models, resume — the graph state survives.**Safety rails**— Scope enforcement via CIDR/target allowlists, rate limiting per adapter, and a mandatory \"dry-run\" mode that logs planned actions without executing. The AGPL means any SaaS wrapper must expose these controls.\n\n**Getting a local instance running**\n\n```\ngit clone https://github.com/cyberstrike/cyberstrike.git\ncd cyberstrike\npip install -e .[local-llm]   # pulls llama-cpp-python, FAISS, etc.\ncp config.example.yaml config.yaml\n# edit config.yaml — set your target scope, LLM endpoint, adapter paths\ncyberstrike init --workspace ./my-campaign\ncyberstrike run --goal \"achieve domain admin\" --dry-run\n```\n\nThe dry-run output shows the generated attack graph with confidence scores per node. Once you're comfortable, drop `--dry-run`\n\nand it starts executing against the scope.\n\n**Where it shines and where it doesn't**\n\n**Strengths**: Handles multi-step logic that single-shot prompts butcher. The evidence collector auto-correlates logs, pcaps, and tool output into a timeline — huge for reporting. Local model support means air-gapped environments work.**Gaps**: BloodHound adapter only ingests JSON, doesn't drive the GUI. No built-in C2 framework integration yet (Cobalt Strike, Sliver, Havoc are on the roadmap). LLM hallucination on obscure protocol edges still happens — always verify before firing.\n\n**Licensing catch**\n\nAGPL-3.0 triggers if you expose CyberStrike as a network service. If you're building a commercial pentest platform on top, you must open-source your modifications. Several vendors have already reached out about dual-licensing; the maintainers seem open but haven't announced anything.\n\nWorth cloning if you run internal red-team exercises and want reproducible, auditable AI assistance. The codebase is clean — typed Python 3.11+, decent test coverage, and the module interfaces are stable enough to build custom adapters without fighting the core.\n\n[OpenAI spent months training models that were actively 14d ago](/en/news/5466/)\n\n[How a Hacker Used DeepSeek AI to Autonomously Attack Servers 21d ago](/en/news/4591/)\n\n[Anthropic AI Hacked 3 Orgs During Testing: A Deep Dive 21d ago](/en/news/4577/)\n\n[Three organizations got breached in a controlled exercise — and 22d ago](/en/news/4521/)\n\n[Next Retiring boomers are taking the institutional knowledge AI needs →](/en/news/7301/)\n\n[an AI side-hustle playbook](https://tanyan888.com/), with plenty of directly applicable cases.", "url": "https://wpnews.pro/news/cyberstrike-drops-an-agpl-harness-for-ai-driven-red-teaming", "canonical_source": "https://promptcube3.com/en/news/7305/", "published_at": "2026-08-22 11:19:59+00:00", "updated_at": "2026-08-22 11:42:53.937585+00:00", "lang": "en", "topics": ["ai-tools", "ai-agents", "ai-safety", "ai-policy"], "entities": ["CyberStrike", "Llama-3-70B", "Claude", "GPT-4o", "nmap", "BloodHound", "CrackMapExec", "Impacket"], "alternates": {"html": "https://wpnews.pro/news/cyberstrike-drops-an-agpl-harness-for-ai-driven-red-teaming", "markdown": "https://wpnews.pro/news/cyberstrike-drops-an-agpl-harness-for-ai-driven-red-teaming.md", "text": "https://wpnews.pro/news/cyberstrike-drops-an-agpl-harness-for-ai-driven-red-teaming.txt", "jsonld": "https://wpnews.pro/news/cyberstrike-drops-an-agpl-harness-for-ai-driven-red-teaming.jsonld"}}