ArgusRed: Post-Trained LLM for Automated Security Scanning and Penetration Testing

ArgusRed is a CLI tool designed for automated security auditing and active penetration testing. Unlike general-purpose large language models (LLMs) that typically refuse to generate exploit code or perform offensive security tasks, ArgusRed utilizes a model post-trained by Cosine specifically for offensive security to ensure it can analyze and attack code without artificial refusals.

Two Operational Modes: Security Scan and Pen Test

ArgusRed operates in two distinct modes to separate static analysis from active exploitation.

Security Scan (Static Analysis)

The Security Scan mode reads the codebase to identify vulnerabilities. It is designed to be non-destructive and read-only, enforced by a Go harness that intercepts and blocks all mutating tool calls (such as file writes or command execution) regardless of the model's intent.

Key capabilities of the Security Scan include:

  • Vulnerability Modules: Analysis covers dependency vulnerabilities, secret and credential detection, SQL injection/XSS vectors, input validation, and file permission controls.
  • Exploit Verification: Users can optionally enable verification to prove findings are not theoretical. This can be run in an ephemeral Docker container or against a live file system (where the Go harness still blocks writes).
  • Performance: Scans scale sub-linearly with codebase size due to a parallel swarm architecture. For example, a 30k LOC project (Bank of Anthos) took approximately 10 minutes, while a 1.5M LOC project (Symfony) took 40 minutes.
  • Output: The result is a Markdown report containing an executive summary, severity ratings, cause analysis, and fix directions.

Pen Test (Active Exploitation)

The Pen Test mode is an active offensive tool that attempts to execute exploits against authorized systems. Because of the high security implications, this mode is gated behind a booking process where targets, scope, and authorization are formally documented.

Key constraints of the Pen Test mode include:

  • Strict Scoping: The agent's network egress is limited to the authorized targets provided during booking; it cannot expand its scope even if it discovers new targets.
  • Time-Boxing: The process stops automatically once the booked time-box is reached.
  • Controlled Effort: Users can select the effort level (from Recon Light to Aggressive), which determines the techniques used, such as port fingerprinting, payload injection, or exploit chain construction.
  • Output: The result is an engagement summary detailing confirmed exploits, CVSS scores, and reproduction scripts.

Technical Architecture and Safety

ArgusRed is distributed as a closed binary that runs locally on the user's machine. It is built on a model post-trained by Cosine, rather than being a prompt wrapper for an external API.

The Go Harness

Safety is not implemented as a set of model-level refusals, but as a deterministic guardrail. A Go harness sits below the model and intercepts every tool call. In Security Scan mode, the model is physically unable to modify the code. In Pen Test mode, the network is restricted to authorized targets.

Post-Training Rationale

Cosine developed a custom post-trained model because off-the-shelf models often refuse to analyze the specific parts of the code that are most critical for security auditing. By removing these refusals through post-training, the tool can perform deep security analysis that general-purpose models would otherwise block.

Community Insights and Discussion

Discussion on Hacker News highlighted several perspectives on the availability and ethics of offensive AI tools:

"IMO the most interesting thing about this is Kimi K2.6, an extremely capable model, can be relatively easily post-trained to allow pen tests. This in its own right proves that the defenses of Fable and others are temporary blocks, and AI based hacking is going to be effectively available to all parties regardless of stop gaps, as long as open models exist."

Other users pointed out that uncensored or "abliterated" open-weight models (such as Qwen variants) already comply with offensive requests, suggesting that the unique value of ArgusRed lies in its specific post-training for security tasks rather than the mere removal of refusals.

Sources