AttackGen is an open-source cybersecurity tool that uses large language models to generate tailored incident response tabletop scenarios from the MITRE ATT&CK and MITRE ATLAS frameworks. It has about 1,300 stars on GitHub, is licensed under GPL-3.0, and is actively developed with updates in 2026.
Preparing a realistic incident response exercise is slow, expert work. AttackGen speeds it up: pick a threat actor group or an AI attack case study, describe your organisation’s size and industry, and the tool drafts a detailed scenario grounded in the techniques that actor is actually known to use. It covers ATT&CK Enterprise and ICS as well as ATLAS, the framework for attacks on AI systems, and can build custom scenarios from hand-picked techniques or ready-made templates for common incident types. Recent versions add an MCP server so the generator can be driven from AI agent workflows, making it a practical companion for purple-team and preparedness programs.
The generated exercises are delivered as facilitator-ready material: a scenario storyline, the attacker techniques involved and structured content that a facilitator can adapt into injects and discussion points with minimal extra preparation. Optional LangSmith integration provides tracing of the generation process, which helps authors inspect and improve the prompts behind the scenarios.
AttackGen is free and open source under the GPL-3.0 license. You run it yourself and supply your own LLM API key, so the only cost is your model usage.
AttackGen is for security teams, incident response leads and consultants who run tabletop exercises and want realistic, framework-grounded scenarios without spending days writing them by hand.