Decepticon is an autonomous red team agent that uses large language models and agentic workflows to conduct security testing engagements.
The tool addresses the limitation of conventional penetration testing automation, which typically runs isolated commands and generates reports without reasoning or adaptation. Decepticon operates as an autonomous agent that can plan multi-step attack sequences, interpret results, and adjust its approach based on findings. It integrates LangGraph for workflow orchestration and LiteLLM for model abstraction, allowing it to coordinate reconnaissance, exploitation, and post-exploitation activities across a sandboxed environment. The agent maintains context across actions and can leverage specialized tools including BloodHound CE for Active Directory analysis, Sliver C2 for command and control, and Ghidra MCP for binary analysis.
Teams should adopt this tool if they need red team automation that goes beyond running individual security scanners. It suits organizations conducting internal security assessments, red team exercises, or security research where autonomous reasoning about attack chains matters more than simple tool execution. The project offers both self-hosted deployment via Docker Compose and a cloud-hosted version accessible through a web interface, removing infrastructure barriers for teams without containerization expertise. The modular architecture allows use as a library through its Python SDK for teams building custom orchestrators or integrating autonomous testing into larger security platforms.
The project maintains active development with regular updates to its core agent capabilities and specialist tool integrations. The team actively expands the toolkit with new specialized workloads that can be spawned on demand. Documentation is comprehensive, covering both quick-start paths and detailed setup procedures across multiple operating systems and architectures. The project provides multiple engagement channels including a live web application, Discord community, and detailed technical documentation, indicating sustained investment in both the tool and its user experience.
