Yean-Sec/StrikeAgent_AtkBrain-Flash

What this is

StrikeAgent_AtkBrain-Flash is a real, working AI agent platform for automated penetration testing (offensive security). It's not a demo or a list of links — it's a full application with a web console, backend API, and an LLM-driven agent that autonomously scans targets, finds vulnerabilities, exploits them, and writes up a report.

The core idea: an AI "brain" that runs a self-loop — it plans an attack, executes it, learns from what worked, and improves its playbook for the next target. The team calls this "self-loop, self-supervised, self-evolving."

How it works

• Console + agent split: A web console (the "master") schedules reconnaissance and manages projects. The AI agent (the "servant") runs attack rounds and only reports back when it finishes a full cycle, gets stuck, or hits a time limit. You can interrupt it mid-round by typing in the chat.
• Attack graph: The system builds a visual attack graph showing discovered hosts, services, and vulnerability paths — the same kind of map a human pentester would draw.
• Model-agnostic: The agent runtime (called "Pi") reads its model config from a JSON file. You pick OpenAI or Anthropic models, set the base URL and API key in the settings page.
• Memory: After each engagement, the techniques that worked are "distilled" into a knowledge base, so the agent gets better over time.
• Modes: Red team (get a shell), CTF (capture the flag), and blue team / SRC (security response center) workflows.

Safety and security built in

The project takes platform security seriously:

• The login page lives at a random 8-character path stored only on the local machine — unauthenticated visitors get a 404 everywhere else.
• Passwords are Argon2id-hashed; login uses RSA-OAEP encryption, one-time tickets (120s expiry), and IP/user lockout.
• It hard-blocks testing on gov/edu domains and ships with no proxies, no evasion, no bypass tooling.
• License is AGPL-3.0 (free for personal/open-source use; commercial requires a paid license).

Deployment

Two options: Docker (console + Pi + common scanning tools in one image) or bare Linux (systemd services, Python 3.11+, Node 20+). The backend API runs on port 2333, the HTTPS frontend on 2334. All data lives in backend/data/ and survives upgrades.

Proof it works

The project took 1st place in Tsecbench v1 (97.89/100), a benchmark for intelligent attack-defense agents run by Tencent Security's Cloud Ding Lab. The team also claims the Pro version has been deployed against "thousands of authorized external environments" across dozens of projects.

Bottom line

This is a substantial, production-oriented AI agent for authorized penetration testing — not a toy. It combines LLM reasoning, autonomous tool use, attack-graph planning, and self-improving memory into a deployable security product.