Decepticon is an autonomous hacking agent for red teams: an LLM-driven system, built on LangChain and LangGraph, that plans and executes penetration-testing engagements โ reconnaissance, exploitation and reporting โ with far less hand-holding than a scanner. It runs self-hosted with Docker on macOS and Linux, or in the project’s hosted cloud if you would rather skip the setup. The open-source project from BitterSecurity has about 6,400 stars on GitHub and is under active development in 2026.
Most “AI pentest” tools amount to running nmap and dressing up the output as a report. Decepticon aims at the actual workflow of an autonomous red-team operator: it reasons about a target, chooses and chains techniques, adapts when an exploit path fails, and documents what it did. The agent architecture separates planning from execution, so engagements can run for extended periods against scoped targets in a lab or authorized environment. A commercial cloud version runs engagements from the browser, while the open-source CLI edition gives security teams full control over models, data and scope on their own infrastructure. As with any offensive security tool, it is intended strictly for authorized testing of systems you own or have permission to assess.
Decepticon’s open-source CLI is free under the Apache-2.0 license for self-hosting. The team also offers a hosted cloud version for running engagements without managing infrastructure, so the overall offering is freemium.
Decepticon is for red teams, penetration testers and security researchers who want to automate the repetitive parts of authorized engagements, and for defenders who want to understand and evaluate autonomous offensive agents in controlled environments.