DEV Community

Cover image for T3MP3ST: Multi-Agent Red-Team Framework That Weaponizes Your Coding Agent
mech.app
mech.app

Posted on Originally published at mech.app

T3MP3ST: Multi-Agent Red-Team Framework That Weaponizes Your Coding Agent

T3MP3ST is a multi-agent offensive security framework that repurposes the AI coding agent you already run (Claude Code, Codex, Ollama) into an autonomous penetration testing tool. It hit GitHub Trending #5 for TypeScript with a claim that sounds too good: 90.1% pass@1 on XBOW's 104-challenge suite, above XBOW's self-reported 85%, with every number reproducible via npm run verify-claims. T3MP3ST is designed for authorized red-team exercises in controlled environments, not for general-purpose penetration testing or unauthorized access.

The architecture is unusual. No central orchestrator, no cloud backend, no new API keys. T3MP3ST provides tools and a kill-chain structure (recon → exploit → report), then hands control to the coding agent session you're already authenticated to. The agent becomes the brain. T3MP3ST is the arsenal.

This raises immediate questions about execution boundaries, sandbox escape risk, and how you benchmark offensive agent capabilities without creating a new attack surface.

Architecture: Keyless Multi-Agent Kill Chain

T3MP3ST does not run its own LLM inference. It integrates with whatever coding agent you already have:

  • Claude Code via the Anthropic desktop app
  • Codex through GitHub Copilot CLI
  • Ollama, LM Studio, vLLM for fully offline models

The framework provides three agent roles:

  1. Recon Agent: Enumerates attack surface (ports, services, endpoints, CVE databases)
  2. Exploit Agent: Attempts exploitation based on recon findings
  3. Report Agent: Generates structured output (Markdown, JSON, SARIF)

Each agent is a TypeScript module that exposes tools to the host coding agent. The host agent decides when to call which tool. There is no supervisor process orchestrating handoffs between agents. Instead, the framework relies on the coding agent's native tool-use loop to sequence the kill chain.

Execution Flow 

// Simplified agent invocation (conceptual)
const reconTools = [
  { name: "nmap_scan", schema: nmapSchema },
  { name: "cve_lookup", schema: cveSchema },
  { name: "subdomain_enum", schema: subdomainSchema }
];

const exploitTools = [
  { name: "sql_injection", schema: sqlSchema },
  { name: "xss_probe", schema: xssSchema },
  { name: "rce_attempt", schema: rceSchema }
];

// Host agent receives tools, decides sequence
await codingAgent.run({
  systemPrompt: "You are a red-team operator. Recon first, exploit second.",
  tools: [...reconTools, ...exploitTools],
  target: "https://authorized-target.example.com"
});
Enter fullscreen mode Exit fullscreen mode

The coding agent sees all tools at once. The system prompt and tool descriptions guide sequencing. If the agent calls nmap_scan before sql_injection, that's the recon-then-exploit pattern. If it calls rce_attempt without recon, the framework does not block it.

State Management

T3MP3ST stores intermediate results in a local SQLite database:

  • Recon findings (open ports, detected services, CVE matches)
  • Exploit attempts (payloads sent, responses received, success flags)
  • Report artifacts (screenshots, packet captures, logs)

Each tool call writes to this database. The next tool call can query it. This gives the agent memory across the kill chain without requiring the framework to manage conversation history.

The database schema is flat:

Table Columns Purpose
findings id, target, tool, timestamp, data_json Recon output
exploits id, finding_id, payload, response, success Exploit attempts
reports id, format, content, timestamp Final deliverables

No complex state machine. The agent reads from findings, writes to exploits, and the report agent queries both tables to generate output.

Security Boundaries and Sandbox Escape Risk

The framework does not sandbox the coding agent. If the agent has shell access (which Claude Code and Codex do by default), T3MP3ST's tools inherit that access.

Tool Execution Model

Each tool is a TypeScript function that the coding agent invokes via tool-use API. For example, the nmap_scan tool:

async function nmapScan(target: string, ports: string): Promise<ScanResult> {
  const cmd = `nmap -p ${ports} ${target}`;
  const { stdout, stderr } = await execAsync(cmd);
  return parseScanOutput(stdout);
}
Enter fullscreen mode Exit fullscreen mode

This runs nmap as a subprocess. If the coding agent can execute shell commands, it can run nmap. If it can run nmap, it can run anything else.

Containment Strategies

T3MP3ST does not enforce containment. The README assumes you are running it in an environment you control:

  • A dedicated VM for red-team work
  • A Docker container with network isolation
  • A cloud instance with egress filtering

The framework provides no built-in sandboxing. If you point it at an unauthorized target, the coding agent will attempt exploitation. If the agent is compromised (via prompt injection or model jailbreak), it can use T3MP3ST's tools to pivot.

Failure Modes

Failure Cause Mitigation
Unauthorized target exploitation Agent ignores system prompt constraints Pre-flight target validation in tool code
Sandbox escape via tool misuse Agent chains tools to escalate privileges Run in isolated VM with no sensitive data
Data exfiltration through report agent Agent embeds credentials in Markdown output Post-process reports to strip secrets
Prompt injection via recon output Malicious target injects commands into scan results Sanitize all tool outputs before returning to agent

A common failure mode is the agent ignoring target restrictions. The system prompt says "only authorized targets," but the agent may not enforce this if the user or a prior prompt says otherwise.

Reproducible Benchmark Infrastructure

T3MP3ST claims 90.1% pass@1 on XBOW's 104-challenge suite. The verify-claims script recomputes this from committed data:

npm run verify-claims
# Output:
# ✓ XBOW pass@1: 90.1% (94/104 challenges)
# ✓ CTF solves: 12/15 hint-free
# ✓ CVE cold hunt: 3/5 post-cutoff exploits
# ✓ All 27 claims verified
Enter fullscreen mode Exit fullscreen mode

How Verification Works

The repository includes:

  • benchmarks/xbow/challenges.json: Full XBOW challenge set
  • benchmarks/xbow/results/*.json: Agent outputs for each challenge
  • scripts/verify.ts: Scoring logic that checks success criteria

Each result file contains:

{
  "challenge_id": "xbow-042",
  "agent_output": "...",
  "exploit_payload": "...",
  "success": true,
  "timestamp": "2026-11-01T14:23:10Z"
}
Enter fullscreen mode Exit fullscreen mode

The verification script:

  1. Loads all challenge definitions
  2. Loads all result files
  3. Checks if success: true matches the challenge's success criteria (e.g., flag extracted, shell obtained)
  4. Computes pass@1 as (successful_challenges / total_challenges) * 100

This is not a live benchmark. The results are pre-recorded. The script verifies that the claimed score matches the committed data. It does not re-run the agent against the challenges.

Why This Matters

Most agent benchmarks report numbers without reproducible artifacts. You see "85% on XBOW" but cannot verify it. T3MP3ST commits the raw outputs and the scoring logic. You can audit both.

The downside: the benchmark measures past performance, not current capability. If you change the agent or the tools, the score may differ. The verify-claims script only confirms that the historical claim is accurate.

Observability and Debugging

T3MP3ST logs every tool call to logs/agent-trace.jsonl:

{"timestamp":"2026-11-06T20:15:30Z","tool":"nmap_scan","target":"192.168.1.1","ports":"1-1000","duration_ms":4523}
{"timestamp":"2026-11-06T20:15:35Z","tool":"cve_lookup","service":"OpenSSH 7.4","cves_found":3}
{"timestamp":"2026-11-06T20:15:40Z","tool":"sql_injection","endpoint":"/login","payload":"' OR 1=1--","success":false}
Enter fullscreen mode Exit fullscreen mode

Each line is a structured log entry. You can grep for failures, measure tool latency, or replay the sequence.

The War Room UI (a browser-based dashboard) visualizes this log in real time:

  • Timeline of tool calls
  • Success/failure indicators
  • Payloads and responses
  • Links to findings in the SQLite database

The UI is a static HTML page that polls logs/agent-trace.jsonl every second. No WebSocket, no server-side rendering. This keeps the deployment simple but limits real-time interactivity.

Deployment Shape

T3MP3ST is a local-first tool. You clone the repo, run npm install, and start the War Room:

git clone https://github.com/elder-plinius/T3MP3ST
cd T3MP3ST
npm install
npm run war-room
Enter fullscreen mode Exit fullscreen mode

This launches a local HTTP server on http://localhost:3000. The War Room UI loads. You configure your coding agent (Claude Code, Ollama, etc.) to use T3MP3ST's tools by pointing it at http://localhost:3000/tools.

The coding agent makes HTTP requests to this endpoint to discover available tools. Each tool is exposed as a JSON-RPC method. The agent calls the method, T3MP3ST executes the tool, and returns the result.

Network Topology 

┌─────────────────┐
│  Coding Agent   │ (Claude Code, Ollama, etc.)
│  (localhost)    │
└────────┬────────┘
         │ HTTP (tool calls)
         ▼
┌─────────────────┐
│  T3MP3ST Server │ (localhost:3000)
│  (Node.js)      │
└────────┬────────┘
         │ Subprocess execution
         ▼
┌─────────────────┐
│  Offensive Tools│ (nmap, sqlmap, etc.)
│  (local binaries)│
└─────────────────┘
Enter fullscreen mode Exit fullscreen mode

Everything runs on the same machine. The coding agent does not need internet access to use T3MP3ST (unless the target is remote). This makes it viable for air-gapped red-team labs.

Docker Deployment

The repository includes a Dockerfile:

FROM node:20-alpine
RUN apk add --no-cache nmap sqlmap metasploit
WORKDIR /app
COPY package*.json ./
RUN npm ci --production
COPY . .
EXPOSE 3000
CMD ["npm", "run", "war-room"]
Enter fullscreen mode Exit fullscreen mode

This bundles T3MP3ST and its offensive tools into a single container. You can run it with network isolation:

docker run --rm --network none -p 3000:3000 t3mp3st
Enter fullscreen mode Exit fullscreen mode

The --network none flag prevents outbound access from the container. For authorized targets, attach the container to a specific Docker network or use --network host only in isolated test environments.

Technical Verdict

Use T3MP3ST when:

  • You already run an AI coding agent (Claude Code, Ollama) and want to repurpose it for red-team work without new API costs.
  • You can isolate the execution environment in a dedicated VM or container that is network-segmented from production systems.
  • Your threat model includes testing agent prompt injection or tool-use vulnerabilities, and you need a framework that exposes these attack surfaces deliberately.
  • You need reproducible offensive security benchmarks with auditable artifacts for compliance or research documentation.
  • You operate in an air-gapped or self-hosted environment where cloud-based security tools are not viable.

Avoid T3MP3ST when:

  • You cannot guarantee network isolation from production systems. The framework assumes you control the execution environment and will not prevent the agent from attacking unauthorized targets.
  • Your coding agent will be exposed to untrusted user input or multi-tenant environments. The lack of sandboxing means a compromised agent can use T3MP3ST's tools to pivot.
  • You need production-grade audit logs with tamper-evidence or cryptographic signing. The JSON Lines format is simple but not compliance-ready.
  • You require real-time collaboration or multi-user access. The War Room UI is single-user and local-first.
  • You want a turnkey solution with guardrails. T3MP3ST is a framework that assumes you will write custom tools, prompts, and validation logic.

The keyless architecture is the standout design choice. By delegating orchestration to the coding agent's native tool-use loop, T3MP3ST avoids the complexity of a central supervisor. The tradeoff is that the agent can ignore the intended kill-chain sequence. If the agent calls exploit tools before recon tools, the framework does not stop it. This is acceptable for authorized red-team exercises where you control the agent's system prompt and the target environment, but it becomes a liability if the agent is exposed to adversarial inputs.

The reproducible benchmark system makes the 90.1% claim auditable by committing raw outputs and scoring logic. The limitation is that the benchmark is historical and does not measure current capability if you change the agent or tools. The cold hunt on post-cutoff CVEs (3/5 exploits) is more compelling evidence of generalization, but the sample size is small.

The security boundary is the weakest part. T3MP3ST provides no sandboxing. If the coding agent is compromised, the offensive tools become an attack vector. Run it in a VM you can safely discard, and ensure the VM has no access to sensitive networks or credentials.

Source Links

Top comments (0)