Decepticon: The Autonomous Red Team Agent — Complete Guide
Decepticon is a professional autonomous red team agent that executes realistic attack chains with RoE enforcement, sandboxed containers, and a Neo4j knowledge graph. Full guide with benchmarks and deployment options.
Most "AI hackers" are glorified nmap wrappers: scan, print a report, call it a pentest. Decepticon is not that. It is a professional autonomous red team agent that executes realistic attack chains — reconnaissance, exploitation, privilege escalation, lateral movement, and C2 — the way a real adversary would. With 5,000+ GitHub stars and an Apache-2.0 license, it's one of the fastest-growing offensive security projects of 2026.
🚀 Want to deploy Decepticon yourself?
Docker configs, system requirements, and installation guides — all on one page.
View Decepticon Tool Page →What Makes Decepticon Different?
Decepticon operates under the discipline that separates red teamers from script kiddies. Before a single packet leaves the wire, it generates a complete engagement package: Rules of Engagement (RoE), ConOps, a Deconfliction Plan, and an OPPLAN with MITRE ATT&CK mapping. Every action runs inside those defined rules.
Core Capabilities
| Capability | Why It Matters |
|---|---|
| Autonomous kill chains | Reads an OPPLAN and pursues objectives through pivoting, adapting, and chaining techniques |
| Sandboxed execution | Every command runs in isolated containers — safe for your host |
| Neo4j knowledge graph | Stores findings, hosts, credentials, and attack paths as a queryable graph |
| Interactive shells | Real offensive tools — msfconsole, sliver-client, evil-winrm — not canned output |
| Web UI + MCP | Full control via browser, plus MCP integration for your AI workflow |
Benchmark Results
On the XBOW validation benchmarks, Decepticon scores 102/104 (98.08%) across all difficulty levels — including 45/45 on easy and 50/51 on medium challenges.
💡 Security note: Decepticon is a dual-use offensive tool. Always run it in sanctioned environments — your own labs, CTFs, or with explicit written authorization. The built-in RoE enforcement is a feature, not a suggestion.
Deployment Options
Decepticon ships as Docker images (ghcr.io/purpleailab/decepticon-sandbox + decepticon-litellm) with a one-line installer, or as a Python SDK (pip install decepticon) for custom orchestrators. A hosted cloud version is available at app.decepticon.red.
🚀 Ready to run your own red team agent?
Get the requirements, Docker Compose config, and full install guide.
View Decepticon Tool Page →