The AI coding agent on your laptop — the same one finishing your PRs, scaffolding your APIs, suggesting fixes — can now be routed through a complete offensive security kill chain. T3MP3ST, released by security researcher elder-plinius on GitHub in early July 2026, is an open-source meta-harness that wraps Claude Code, OpenAI’s Codex, or Hermes in an 8-operator red-team framework covering reconnaissance through reporting. No new API key. No new cloud account. No new billing. The agent already running on your machine is the operative. And on XBOW’s own 104-challenge XBEN benchmark, it scored 90.1% pass@1 — beating XBOW’s self-reported 85% on its own test.
What T3MP3ST Actually Is #
T3MP3ST doesn’t ship its own AI model. It’s a multi-agent orchestration layer — a meta-harness — that coordinates your existing local agent through a structured kill chain aligned with MITRE ATT&CK tactics. Point it at an authorized target via the browser-based War Room UI (http://127.0.0.1:3333/ui/
), describe the target in plain English, and the Op Admiral agent routes work through eight specialized operators: Recon, Scanner, Exploiter, Infiltrator, Exfiltrator, Ghost, Coordinator, and Analyst. Each runs a ReAct (Reasoning + Acting) loop backed by real tool execution — nmap, metasploit, hydra, frida, and 31 more bundled tools — not just language generation.
Setup takes about two minutes:
npm install
npm run server
The framework also supports direct API keys (OpenRouter, Anthropic, OpenAI) and runs fully offline via Ollama. Docker is supported. MCP integration is supported. The HTTP API and JavaScript SDK let you drive missions programmatically. For a tool published by an independent researcher, the surface area is remarkably complete.
The Benchmark Numbers and Why They’re Credible #
AI security tools are full of claims that can’t be verified. T3MP3ST does something genuinely different: every headline number recomputes from committed JSON artifacts via npm run verify-claims
(27/27 verification gates, run on every push). The results:
| Benchmark | T3MP3ST | Context |
|---|---|---|
| XBEN (104 challenges, black-box) | 90.1% pass@1 | XBOW self-reports ~85% on its own suite |
| Cybench (40 academic challenges) | 23/40 (58%) | Hint-free, Opus 4.8 |
| CVE-Zero (10 real 2026 CVEs) | 8/10 exact + 10/10 surfaced | Post-training-cutoff, 7 languages |
The XBEN context matters. XBOW isn’t an academic toy — it’s the automated system that reached #1 on HackerOne’s leaderboard in 2025, ahead of every human researcher, finding over 14,000 real zero-days in production applications. Beating XBOW’s number on XBOW’s benchmark, with reproducible artifacts, is the kind of result that deserves scrutiny — and T3MP3ST’s verification system invites it.
The CVE-Zero results are arguably more striking. Ten real vulnerabilities disclosed in 2026, held out from training. A single agent pinned 8 of 10 to the exact file, line number, and CWE classification. The full tool pack surfaced all 10. These bugs postdate the model’s training cutoff — the agent isn’t recalling patterns. It’s reasoning about novel vulnerabilities in code it hasn’t seen before.
Keyless Warfare: What the Design Choice Actually Means #
The “keyless warfare” framing isn’t marketing. It’s a specific technical decision with real consequences. T3MP3ST reuses the operator’s existing agent session, which means the marginal cost of running an autonomous red-team operation is close to zero for anyone already paying for Claude Code or Codex access. No new procurement, no new vendor relationship, no new account to justify to a budget committee.
This cuts both ways. For defenders and security researchers with authorized targets, it removes the infrastructure barrier that made this kind of testing expensive. For threat actors, it removes the same barrier. The same low-cost, no-new-infrastructure design that makes T3MP3ST useful for bug bounty work also makes it accessible to less sophisticated actors automating parts of the attack chain. Elder-plinius ships egress-scope containment — networked tools refuse off-scope requests with a SCOPE DENIED
response — but that’s an authorization control, not a technical barrier to misuse.
The Frame Shift: AI Agents as Attackers #
Earlier this year, ByteIota covered GuardFall — the attack pattern where shell injection hits AI coding agents, turning them from tools into attack surfaces. T3MP3ST inverts that frame completely. The same agents that were victims in that story are now the operators in this one. The agent writing your code is now capable of auditing your infrastructure, finding the vulnerabilities your team missed, and generating a report with reproducible proof of exploitation.
The 2026 context makes this more pointed. State-sponsored actors have already used hijacked AI coding agent sessions to execute 80–90% of espionage operations. “Friendly Fire” attacks — where agents asked to scan repositories for vulnerabilities get tricked into running attacker-controlled code — are documented and live. The expectation that your coding agent is a neutral productivity tool is outdated. T3MP3ST makes that explicit. Offensive capability is now in scope for the same agent you use for autocomplete.
What You Need to Know Before Running It #
T3MP3ST is released under AGPL-3.0, which means derivative works must also be open source. The framework is explicitly for authorized testing only — systems you own or have written permission to target. Unauthorized use remains illegal in most jurisdictions; the code ships with a clear disclaimer and no warranty. The downstream operators (Infiltrator, Exfiltrator, Ghost) are marked experimental as of July 2026 — the recon and single-agent exploit paths are the production-ready surface. Multi-agent coordination is real but rough at the edges.
For developers running authorized infrastructure, working in security research, or preparing bug bounty submissions: T3MP3ST is worth evaluating in a lab environment first. Review the evidence the tool produces — it separates model observations (hypotheses) from validated findings backed by actual tool output. CyberSecurityNews and SecureBulletin both note that the tool’s value depends on operator discipline — short, well-scoped runs with clear artifacts. Proof over narrative. That’s the right standard for any autonomous security tool, and T3MP3ST at least builds it into the architecture.
The agent that ships your features can now ship a vulnerability report on your infrastructure. That’s a meaningful capability shift, and in 2026, it’s arrived without a lot of fanfare.