PurpleAILAB/Decepticon

What it solves

Decepticon is an autonomous red teaming agent designed to move beyond simple vulnerability scanning. It automates complex, multi-step attack chains—including reconnaissance, exploitation, privilege escalation, and lateral movement—while adhering to professional engagement standards like Rules of Engagement (RoE) and Concept of Operations (ConOps).

How it works

The system uses a two-network architecture to isolate the management plane (orchestration and data) from the sandbox plane (where attacks are executed). It employs a team of 16 specialist agents organized by kill chain phase, coordinated via LangGraph. These agents operate within a Kali Linux sandbox and can handle interactive shells (like msfconsole or sliver-client) using persistent tmux sessions. Findings are persisted in a Neo4j knowledge graph to track attack paths.

Who it’s for

It is built for professional red teamers and security researchers who need to automate realistic adversary simulations to identify security gaps and develop "offensive vaccines" (defense improvements based on verified attacks).

Highlights

• Full Kill Chain Automation: Executes realistic attack sequences rather than just running isolated scans.
• Professional Governance: Generates RoE, Deconfliction Plans, and OPPLANs with MITRE ATT&CK mapping before execution.
• Interactive Tool Support: Handles interactive CLI prompts automatically via tmux sessions.
• Hardened Isolation: Uses a dedicated operational network and Docker-based Kali Linux sandbox.
• Multi-Model Fallback: Supports a wide range of providers (Anthropic, OpenAI, Gemini, etc.) with tier-based fallback chains.