Loading story…
Two new AI-assisted offensive security efforts were highlighted: BlacksmithAI, an open-source penetration testing framework, and a Kali Linux workflow that enables natural-language control of common pentesting tools via Anthropic’s Claude. BlacksmithAI is described as a hierarchical, multi-agent system where an orchestrator decomposes assessment goals and delegates work to specialized agents aligned to typical pentest phases (recon, scanning/enumeration, vulnerability analysis, exploitation, and post-exploitation), then compiles results into reporting.
Separately, Kali Linux was reported to support a native AI-assisted workflow by integrating Claude through the open-source Model Context Protocol (MCP), using an mcp-kali-server package to translate plain-English prompts into tool execution (e.g., Nmap/Gobuster/Metasploit), parse outputs, and return structured findings and prioritized reporting. Both items reflect a broader shift toward agentic and conversational interfaces for offensive tooling, reducing reliance on manual CLI syntax while automating planning, execution, and summarization of assessment steps.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
BlacksmithAI was presented as an open-source AI-powered penetration testing framework using a hierarchical multi-agent architecture for reconnaissance, scanning, vulnerability analysis, exploitation, post-exploitation, and reporting. Its author said the design mirrors real pentesting teams, with agents operating in a shared pre-configured container and supporting multiple LLM backends and interfaces.
A newly announced workflow integrated Anthropic's Claude AI with Kali Linux through the open-source Model Context Protocol and the mcp-kali-server package. The setup lets Claude Desktop translate plain-English prompts into execution of tools such as Nmap, Gobuster, and Metasploit, then summarize findings into a prioritized report.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceosintteam.blog
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kali Linux published documentation for an **AI-assisted penetration testing workflow** that uses Anthropic’s **Claude Desktop** as a natural-language interface and the open-source **Model Context Protocol (MCP)** to translate prompts into tool execution on a Kali host. The described architecture separates a GUI “UI layer” (Claude Desktop on macOS/Windows), an “execution layer” (a Kali system running an `mcp-kali-server` bridge that exposes tools), and an “intelligence layer” (Anthropic’s *Claude Sonnet 4.5* in the cloud). The goal is to let operators request tasks like port scanning and web checks in plain language, with the LLM planning and iterating through tool calls while returning structured results. This is **not an incident report** but a capability/workflow enablement that can materially change how offensive tooling is orchestrated, including by lowering the operational friction of chaining common recon and enumeration steps. Organizations evaluating similar agentic workflows should treat the MCP bridge and any AI agent runtime as a privileged automation surface (credentials, tokens, tool execution, and output handling), and consider isolation and least-privilege controls when experimenting with LLM-driven command execution in security tooling environments.
Jun 29, 2026
Recent advancements in AI-driven penetration testing have led to the development and deployment of tools that can autonomously discover and exploit vulnerabilities in web applications. One such tool, Shannon, leverages Anthropic’s Claude Agent SDK to perform comprehensive white-box analysis, autonomously identifying attack paths and executing real browser-based exploits. Shannon has demonstrated performance surpassing human pentesters on industry benchmarks, providing detailed, low-noise reports and simulating the workflows of experienced security engineers. In parallel, practitioners are exploring orchestration techniques to integrate AI models and penetration testing frameworks across different environments. A practical setup involves running large language models on an Ubuntu host and orchestrating the HexStrike penetration testing tool on a Kali Linux virtual machine, bridged via SSH. This configuration enables local AI models to automate and drive penetration testing tasks, with considerations for model performance and the potential need to scale to GPU or cloud-based solutions for more demanding scenarios.
Jun 29, 2026
Two separate research efforts describe using **AI to accelerate and operationalize offensive security workflows** for defenders. Pacific Northwest National Laboratory presented *ALOHA* (Agentic LLMs for Offensive Heuristic Automation), an AI-based system intended to reconstruct real-world attacks from threat reports and generate variants for testing an organization’s defenses, with the stated goal of reducing attack recreation and validation cycles from **weeks to hours**. The work is positioned as enabling faster threat emulation so security teams can more quickly verify whether detections and controls catch newly disclosed techniques. A different academic/industry team (Alias Robotics and Johannes Kepler University Linz) proposed *Generative Cut-the-Rope (G-CTR)*, which combines **AI-driven penetration testing** with **game theory** to turn high-volume AI security testing logs into structured **attack graphs** and compute optimal attacker/defender strategies (e.g., via **Nash equilibria**). The authors claim the approach can convert unstructured outputs into actionable guidance in **seconds**, addressing the common operational problem that automated testing tools generate more data than teams can interpret strategically.
Jun 29, 2026