Decepticon
Autonomous Hacking Agent for Red Team
Last verified:
What is Decepticon?
Decepticon is an autonomous hacking agent built strictly for Red Team Testing, not a traditional vulnerability scanner or standard pentesting tool. It leverages LLMs to understand context, adapt strategies on the fly, and execute complex attack chains without human guidance. The tool operates with stealth and persistence to achieve specific objectives, testing the Blue Team's real detection capabilities.
Key features include an autonomous kill chain that orchestrates the full attack lifecycle (reconnaissance, exploitation, privilege escalation, lateral movement, and persistence) with no human intervention required. It uses context-aware reasoning to identify logical flaws and discover vulnerabilities where human assumptions create exploitable gaps, rather than just matching CVEs. Decepticon operates through real C2 infrastructure via the Sliver framework for stealth operations and includes human authority controls allowing users to pause, redirect, or override any decision in real-time.
Decepticon is designed for cybersecurity professionals, red teamers, and organizations looking to simulate realistic attack scenarios for defense improvement. It functions as an 'offensive vaccine' by deploying AI red teaming against your own infrastructure to find blind spots before real attackers do. The tool is suitable for penetration testing, security audits, and offensive security training, serving teams that want to train and measure defenders by emulating real adversaries end-to-end.
Decepticon pricing
Pricing model: Freemium
Decepticon is open-source and free to install via the CLI (curl -fsSL https://decepticon.red/install | bash). The tool itself has no licensing fee, but requires an LLM provider credential which incurs costs. Supported authentication includes tier-mapped API keys (Anthropic, OpenAI, Google Gemini, MiniMax, DeepSeek, xAI, Mistral, OpenRouter, Nvidia NIM), local LLM via Ollama (no API cost), or subscription OAuth with no per-token billing (Claude Max/Pro/Team, ChatGPT Pro/Plus/Team, Gemini Advanced, Microsoft Copilot Pro, xAI SuperGrok, Perplexity Pro). Over 1,000+ users have signed up to experience Autonomous Red Team Testing.
Decepticon pros
- Fully autonomous kill chain execution without human intervention
- LLM-powered context-aware reasoning beyond CVE matching
- Discovers deep logical and context-based vulnerabilities
- Real C2 infrastructure via Sliver framework for stealth
- Tests Blue Team detection capabilities in real time
- Human-in-the-loop controls for pause/redirect/override
- Supports multiple LLM providers (Anthropic, OpenAI, Gemini, etc.)
- Local LLM support via Ollama for privacy
- Open-source with active GitHub community (3,246+ stars)
- Docker-based deployment with simple CLI installation
- Interactive terminal UI and web dashboard at localhost:3000
- Generates eight-document engagement bundle automatically
- MITRE ATT&CK integration for TTP vocabulary
- Machine-speed attack loops (hours vs weeks for traditional)
- Programmatically expandable full organization scope
Decepticon cons
- Requires Docker and Docker Compose v2 prerequisites
- Needs LLM provider credentials (API key or subscription)
- Only for authorized Red Team Testing, not unauthorized hacking
- Complex setup with multiple services (PostgreSQL, Neo4j, etc.)
- Primarily targets Red Teaming, not basic vulnerability assessment
- Stealth operations may trigger actual security alerts
- Requires explicit written authorization for target systems
- Monthly usage limits apply based on subscription type
Frequently asked questions about Decepticon
What is Decepticon?
Decepticon is an autonomous hacking agent built strictly for Red Team Testing. It is not a traditional vulnerability scanner or standard pentesting tool. It leverages LLMs to understand context, adapt strategies on the fly, and execute complex attack chains autonomously, operating with stealth and persistence to test Blue Team detection capabilities.
How is Decepticon different from traditional penetration testing?
Traditional pentesting focuses on siloed evaluation of individual systems (web, mobile, networks) and finds CVEs. Decepticon automates the Red Teaming mindset, emulating real adversaries end-to-end across the full organization. It tests people, processes, and technology together, operates at machine-speed (hours vs 2-6 weeks), and provides continuous offensive feedback as an 'offensive vaccine'.
What LLM providers does Decepticon support?
Decepticon supports tier-mapped API keys from Anthropic, OpenAI, Google Gemini, MiniMax, DeepSeek, xAI, Mistral, OpenRouter, and Nvidia NIM. It also works with local LLMs via Ollama, subscription OAuth (Claude Max/Pro/Team, ChatGPT Pro/Plus/Team, Gemini Advanced, Microsoft Copilot Pro, xAI SuperGrok, Perplexity Pro), and other providers like Groq, Cohere, Together, Fireworks, Perplexity API, Azure, AWS Bedmark, and Replicate via ad-hoc registration.
How do I install Decepticon?
Install by running: curl -fsSL https://decepticon.red/install | bash. This installs the decepticon CLI to your system. Then run 'decepticon onboard' to launch the interactive setup wizard for authentication, provider selection, credentials, and model profile configuration. Everything runs inside Docker containers.
What is the engagement lifecycle in Decepticon?
The engagement lifecycle follows three phases: Get In (initial access via threat profile vectors like phishing or exposed services), Stay In (establish persistence and C2, maintain OPSEC, survive defender response), and Act (execute objectives like privilege escalation, lateral movement, credential access, data discovery, exfiltration while remaining on-mission within Rules of Engagement).
Is Decepticon safe to use?
Decepticon is built for authorized Red Team Testing only. The documentation explicitly states: 'Only run Decepticon against systems you own or have explicit written authorization to test.' It includes human authority controls allowing you to pause, redirect, or override any decision in real-time with full operational visibility, like a self-driving car where the human is always in control.
What is the 'offensive vaccine' concept?
The offensive vaccine is Decepticon's ultimate goal: not to attack, but to build an impenetrable defense. By deploying this autonomous hacking agent against your own systems, you subject yourself to continuous, relentless attack scenarios. This inoculation exposes blind spots and logical flaws, forcing defensive infrastructure to evolve into a more robust state before real malicious actors strike.
How do I access the web dashboard?
The web dashboard starts as part of the default stack when you run 'decepticon' or 'make dev' for contributors. It is reachable at http://localhost:3000 once the services are running. The dashboard includes the Soundwave agent that interviews you to define the engagement scope, threat actor profile, and Rules of Engagement.
What agents does Decepticon use?
Decepticon is a multi-agent AI system with specialized agents. Soundwave is the agent that interviews you to define the engagement. The orchestrator builds the OPPLAN from the engagement bundle. Decepticon uses MCP (Modular Command Protocol) so agents can call fundamental tools to automate recon, initial access, exploitation, privesc, evasion, persistence, execution, and reporting.
How do I stop Decepticon services?
Run 'decepticon stop' to stop all services while keeping data intact. Run 'make clean' to stop and remove all volumes, which resets everything. You can check service status with 'decepticon status', follow logs with 'decepticon logs' (defaults to LangGraph logs), or follow a specific service's logs like 'decepticon logs litellm'.