Loading story…
Two separate research efforts describe using AI to accelerate and operationalize offensive security workflows for defenders. Pacific Northwest National Laboratory presented ALOHA (Agentic LLMs for Offensive Heuristic Automation), an AI-based system intended to reconstruct real-world attacks from threat reports and generate variants for testing an organization’s defenses, with the stated goal of reducing attack recreation and validation cycles from weeks to hours. The work is positioned as enabling faster threat emulation so security teams can more quickly verify whether detections and controls catch newly disclosed techniques.
A different academic/industry team (Alias Robotics and Johannes Kepler University Linz) proposed Generative Cut-the-Rope (G-CTR), which combines AI-driven penetration testing with game theory to turn high-volume AI security testing logs into structured attack graphs and compute optimal attacker/defender strategies (e.g., via Nash equilibria). The authors claim the approach can convert unstructured outputs into actionable guidance in seconds, addressing the common operational problem that automated testing tools generate more data than teams can interpret strategically.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Pacific Northwest National Laboratory described ALOHA (Agentic LLMs for Offensive Heuristic Automation), an AI system that ingests threat reports, reconstructs likely attack chains, and executes emulations in test environments to validate detections. PNNL said the system can cut attack reconstruction and validation time from weeks to hours and help generate mitigations and tune defensive tools through iterative purple-team testing.
Researchers from Alias Robotics and Johannes Kepler University Linz presented Generative Cut-the-Rope (G-CTR), an automated penetration-testing framework that turns AI security logs into attack graphs, computes Nash equilibria, and feeds optimized attacker and defender guidance back into agent execution. In reported cyber-range and real-world exercises, the system improved success probability, reduced cost and variance, and produced attack graphs that closely matched expert annotations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two new **AI-assisted offensive security** efforts were highlighted: *BlacksmithAI*, an open-source penetration testing framework, and a **Kali Linux** workflow that enables natural-language control of common pentesting tools via Anthropic’s **Claude**. BlacksmithAI is described as a hierarchical, multi-agent system where an orchestrator decomposes assessment goals and delegates work to specialized agents aligned to typical pentest phases (recon, scanning/enumeration, vulnerability analysis, exploitation, and post-exploitation), then compiles results into reporting. Separately, Kali Linux was reported to support a native AI-assisted workflow by integrating Claude through the open-source **Model Context Protocol (MCP)**, using an `mcp-kali-server` package to translate plain-English prompts into tool execution (e.g., Nmap/Gobuster/Metasploit), parse outputs, and return structured findings and prioritized reporting. Both items reflect a broader shift toward **agentic and conversational interfaces** for offensive tooling, reducing reliance on manual CLI syntax while automating planning, execution, and summarization of assessment steps.
Jun 29, 2026
Resecurity warned that autonomous AI offensive security agents are turning penetration testing from scripted automation into adaptive, multi-agent operations that can perform reconnaissance, map attack surfaces, identify vulnerabilities, validate exploits, and generate reports with minimal human input. The report highlighted tools including **T3MP3ST**, **Strix**, **CyberStrike**, **XBOW**, **PentAGI**, **PentestGPT**, **Nebula**, **PentesterFlow**, **Hackian**, and specialized offensive-security LLMs such as `CyberStrike-OffSec-35B`, describing them as increasingly capable dual-use systems. Security researchers said the same capabilities are lowering the barrier for financially motivated criminals and state-backed actors, making AI-assisted offensive operations practical rather than theoretical. The reporting cited examples including **FortiBleed**, **JadePuffer**, **GTG-2002**, **GTG-5004**, and the Claude Desktop “double agent” demonstration, and urged organizations to respond with a hybrid defense model built on human oversight, behavioral detection, network segmentation, continuous exposure validation, governance of AI tooling, and rapid patching of high-value flaws.
Jul 31, 2026
Threat actors are increasingly leveraging artificial intelligence, particularly large language models (LLMs), to automate and enhance cyberattacks. Recent research demonstrates that LLMs such as GPT-4o and Claude can be manipulated to generate working exploits for enterprise software like Odoo ERP, significantly lowering the barrier for less-skilled attackers to launch sophisticated attacks. Concurrently, the underground market is witnessing the emergence of AI-powered malware tools, such as metamorphic crypters, which use AI to dynamically rewrite malicious code and evade detection by endpoint security solutions like Windows Defender. These developments highlight a rapidly evolving threat landscape where AI is both a tool for attackers and a challenge for defenders. In response to these threats, the cybersecurity community is developing advanced AI-powered penetration testing frameworks like NeuroSploitv2. This tool integrates multiple LLMs and employs specialized agent roles, grounding techniques, and safety guardrails to automate vulnerability discovery and exploitation in a controlled, ethical manner. Meanwhile, defenders are also exploring granular attribute-based access control and post-quantum encryption to mitigate risks from context window injections in AI systems. The convergence of AI in both offensive and defensive security operations underscores the urgent need for robust safeguards and adaptive security strategies to address the dual-use nature of these technologies.
Jun 29, 2026