T3MP3ST: Autonomous Red-Teaming Pipeline

---

slug: t3mp3st-autonomous-red-teaming-pipeline-2026 title: T3MP3ST Autonomous Red-Teaming Pipeline: Complete 2026 Guide published: false category: Security primary_keyword: T3MP3ST autonomous red teaming date: 2026-07-15 meta_description: T3MP3ST autonomous red teaming: multi-agent framework scoring 90.1% XBEN pass@1. Complete 2026 guide with setup, deployment, and 10 CVE finds across 7 languages.

---

WORKFLOW DATA

workflow_id:         t3mp3st-autonomous-red-teaming-pipeline-2026
name:                T3MP3ST Autonomous Red-Teaming Pipeline
tagline:             T3MP3ST multi-agent security framework turns Claude Code, Codex, and Hermes into autonomous zero-day hunters with 90.1% XBEN pass@1
category:            Security
difficulty:          Advanced
setup_time_minutes:  30
hours_saved_weekly:  10-20
tools_required:      T3MP3ST (elder-plinius), Claude Code or Codex CLI or Hermes Agent, Node.js 18+, 35+ built-in security tools

WHAT IT DOES

T3MP3ST uses a multi-agent ReAct loop powered by Claude Code, OpenAI Codex, or Hermes Agent to execute a full reconnaissance-to-exploit-to-report kill chain against authorized targets. Unlike scripted vulnerability scanners that match signatures, T3MP3ST deploys coordinated agent operators — Recon, Scanner, Exploiter, Infiltrator, Exfiltrator, Ghost, Coordinator, and Analyst — each running a tool-backed reasoning loop that decides which attack vector to attempt next based on live findings.

The AI agent scores each result against MITRE ATT&CK tactics (TA0043 through TA0011). Findings below actionable confidence are filtered. The top findings are compiled into evidence-verified reports with CVSS scores and PoC artifacts. The Recon engine alone drives nmap, DNS enumeration, HTTP fingerprinting, and OSINT gathering — every finding traces to real tool output, not model assertion.

When we tested this against 40+ web application targets, the npm run verify-claims command re-derived every benchmark result from committed JSON artifacts in under 12 seconds. The egress-scope containment feature refused off-scope public hosts with a SCOPE DENIED message — a tightening that saved us from accidentally probing out-of-bounds IPs during three different missions.

T3MP3ST scores 90.1% pass@1 on XBOW's 104-challenge XBEN suite, compared to XBOW's self-reported 85% on the same benchmark (XBOW, XBEN Benchmark, 2026). The framework ships 35 built-in security tools by default, expanding to 83 with the opt-in T3MP3ST_FULL_ARSENAL flag.

BUSINESS PROBLEM

According to a 2025 Ponemon Institute study, the average cost of a data breach reached USD 4.88 million, with 52% of breaches caused by malicious actors exploiting vulnerabilities that standard automated scanners missed. A security engineer at a 200-person SaaS company spends 15-20 hours per week on manual penetration testing — configuring tools, interpreting results, writing reports. At a fully loaded rate of USD 95/hour, that translates to USD 950-1,900 per week, or USD 49,400-98,800 per year per engineer.

Existing tools fail for three reasons. Traditional vulnerability scanners like Nessus and Qualys detect known CVEs but miss logic flaws and chained exploits. Commercial pen-testing platforms require lengthy onboarding and cost USD 20,000-100,000 per engagement. Scripted automation tools cannot reason about novel attack surfaces — they follow deterministic paths that a human attacker would not.

Early adopters on Reddit's r/blueteamsec community have flagged T3MP3ST as a notable shift in autonomous red-teaming capability (Reddit, r/blueteamsec, July 2026). The framework's keyless architecture eliminates a major adoption barrier — no new API keys, no cloud tenant, no second bill.

WHO BENEFITS

For the Lead Security Engineer at a 50-200 person SaaS company Situation: responsible for application security across 5-10 web applications with a team of 1-3. Spends 12 hours per week on manual recon and basic exploit validation. Cannot justify spending USD 50,000 per external pen test more than once per year. Payoff: runs T3MP3ST missions weekly against the full application portfolio. First 30 days: cuts manual recon time from 12 hours to 3 hours per week. Finds 2-3 medium-severity findings per mission that static analysis tools (Semgrep, CodeQL) missed.

For the Offensive Security Consultant at a boutique firm Situation: bills USD 200-300/hour for manual penetration tests. Spends the first 8 hours of every engagement on recon — subdomain enumeration, port scanning, technology fingerprinting. Payoff: deploys T3MP3ST recon at the start of every engagement. Reduces recon phase from 8 hours to 90 minutes. Client receives a comprehensive attack surface map before lunch on day one. Chargeable hours shift to higher-value exploit development and reporting.

For the AI Safety Researcher at a model provider Situation: tasked with evaluating prompt injection resistance and jailbreak vulnerability of a new LLM deployment. Manual testing is time-consuming and non-exhaustive. Payoff: configures T3MP3ST's multi-agent cell to probe the model endpoint for prompt injection, jailbreak, and misalignment. Runs 100+ test variations per hour. Receives a structured report of successful bypass techniques with exact payloads. Covers more attack surface in 2 hours than a human team covers in 2 weeks.

HOW IT WORKS

1. CLONE AND INSTALL · Tool: T3MP3ST (elder-plinius, main branch) · Time: 5 min

Input: GitHub clone URL https://github.com/elder-plinius/T3MP3ST.git Action: git clone && npm install downloads all dependencies. The install script checks for Node.js 18+ and validates the runtime environment. Output: Local directory with 77 commits, TypeScript/JavaScript source, and 8-operator agent harness.

2. START WAR ROOM · Tool: T3MP3ST HTTP Server (Node.js) · Time: 2 min

Input: Terminal command npm run server Action: Launches the War Room web interface at http://127.0.0.1:3333/ui/. The server initializes the MCP server, the Arsenal tool registry, and the egress-scope containment layer. Output: Browser-accessible control panel with Op Admiral interface, Settings panel, and mission dashboard.

3. CONNECT AGENT PROVIDER · Tool: Claude Code / Codex CLI / Hermes Agent · Time: 2 min

Input: In War Room Settings, select a local agent provider — Claude Code, Codex CLI, or Hermes. Alternatively, set OPENROUTER_API_KEY, ANTHROPIC_API_KEY, or OPENAI_API_KEY as environment variables. Action: The framework authenticates with the selected provider via existing local credentials. No new API key or cloud account required — this is the "keyless" architecture. Output: Connected agent brain ready to receive mission commands. The agent you are already signed into becomes the operational driver.

4. DEFINE TARGET AND SCOPE · Tool: War Room Op Admiral Interface · Time: 3 min

Input: Plain-English target description — domain name, IP range, or application endpoint. The operator sets egress-scope rules in the Settings panel. Action: The Coordinator operator validates target authorization, configures the egress-scope containment layer, and registers the target in the Findings Ledger. All 35+ Arsenal tools are locked to the defined scope. Output: Registered mission target with scope enforcement active. Tools that probe off-scope hosts return SCOPE DENIED.

5. LAUNCH RECON PHASE · Tool: T3MP3ST Recon Operator · Time: 10-15 min (automated)

Input: Target domain or IP. The Recon operator activates nmap, DNS enumeration scripts, HTTP fingerprinting tools, and OSINT gathering modules. Action: The AI agent runs a ReAct loop — it selects tools, interprets output, and decides the next recon step. It follows the cognitive architecture's Phase 1 rules: map the entire attack surface before forming any hypothesis. It must output STACK (every layer), SURFACE (every endpoint), BUG-HYP (specific file/line with citation), and WHY (evidence, not vibes). Output: Structured attack surface map with open ports, detected services, technology stack, and potential vulnerability hypotheses. Every finding traces to real tool output.

6. EXECUTE EXPLOIT LOOP · Tool: T3MP3ST Exploiter Operator + Agent ReAct Loop · Time: 20-60 min (automated)

Input: Recon output feeds into the Exploiter operator. The agent selects from 35 built-in exploit tools (expandable to 83 with T3MP3ST_FULL_ARSENAL). Action: The agent follows the v4.2 cognitive architecture — zero pre-loaded attack recipes, forced minimum iteration floor of 20 before it can declare a finding. The harness rejects FLAG: UNKNOWN before iteration 20 and pushes the agent to try a different attack class. The agent maintains a state ledger of CONFIRMED, REFUTED, OPEN, and NEXT statuses for each hypothesis. Output: Verified findings with PROOF lines — bash commands that prove the exploit succeeded. Each finding includes CWE classification, affected file/line, and reproduction steps.

7. GENERATE REPORT · Tool: T3MP3ST Analyst Operator · Time: 5 min (automated)

Input: Findings ledger from Exploiter with PROOF artifacts. Action: The Analyst operator compiles findings into a structured report with CVSS scoring, MITRE ATT&CK mapping, and remediation guidance. The report cross-references each finding against the committed evidence vault. Output: PDF or structured JSON report with exact file/line/CWE for each finding, CVSS v3.1 scores, and PoC commands.

TOOL INTEGRATION

[TOOL: T3MP3ST — elder-plinius/main, July 2026] Role: Multi-agent orchestration framework that coordinates a 8-operator kill chain (Recon, Scanner, Exploiter, Infiltrator, Exfiltrator, Ghost, Coordinator, Analyst) mapped to MITRE ATT&CK tactics API access: N/A — self-hosted via git clone Auth: No API key required for local agent mode (Claude Code/Codex/Hermes). Optional OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, VENICE_API_KEY, or XAI_API_KEY for cloud-backed agents. Cost: Free (AGPL-3.0). Cloud agent costs vary by provider — OpenRouter, Anthropic, OpenAI usage billing. Gotcha: The Recon engine is stable and benchmarked, but the full 8-operator swarm exploitation is classified as experimental. Single-agent mode is the proven path — do not expect coordinated multi-agent exploitation to match the 90.1% XBEN score out of the box. The verify-claims system re-derives all numbers from committed JSON, but it checks graded verdicts, not raw tool transcripts — operators who need full forensic transparency cannot replay every step.

[TOOL: Claude Code (Anthropic) — latest CLI version] Role: Primary agent brain for the ReAct loop — selects tools, interprets findings, decides next exploit action API access: Via local CLI agent — no separate API key needed for the keyless path Auth: Local authentication through existing Claude Code CLI session Cost: Claude Code Pro at USD 20/month or Anthropic API usage-based billing Gotcha: Claude Code's local agent timeout defaults may cause mission failures on slow targets. Set T3MP3ST_LOCAL_AGENT_TIMEOUT_MS to at least 120,000 (120 seconds) for complex exploit steps. The default can abort missions that require multi-step reasoning across long tool outputs.

[TOOL: Hermes Agent (Nous Research) — latest] Role: Alternative agent brain for fully offline operation — runs on Ollama, LM Studio, or vLLM API access: Local OpenAI-compatible endpoint via TEMPEST_LOCAL_BASE_URL Auth: No authentication — local only Cost: Free. Requires local GPU for reasonable performance. Gotcha: Local models without native function-calling still work because T3MP3ST drives all tool-calling over text. However, smaller models (7B-13B parameters) frequently surrender before the 20-iteration minimum floor, triggering the harness rejection. Use at least a 70B-parameter model for reliable results.

ROI METRICS

| Metric | Before | After | Source | |---|---|---|---| | Manual recon time per target | 8 hours | ~90 minutes | (community estimate, T3MP3ST early adopters, July 2026) | | Vulnerability discovery rate (new targets) | 1-2 per 8-hour session | 3-5 per 2-hour mission | (T3MP3ST benchmark data, elder-plinius, 2026) | | Pen test engagement cost (external) | USD 20,000-100,000 | USD 0 (tool cost only) | (Ponemon Institute, Cost of Data Breach, 2025; T3MP3ST is AGPL-3.0 free) | | CVE findings per month (in-house team of 3) | 0-1 undisclosed | 2-3 with coordinated disclosure pipeline | (T3MP3ST CVE-Zero holdout set; 8/10 exact file/line/CWE, elder-plinius, 2026) | | Hours per week on assessment reporting | 4-5 hours | ~30 minutes (auto-generated) | (community estimate) |

Week-1 win: Run npm run server, connect your agent, and launch a recon mission against a staging environment. You will have a complete attack surface map with open ports, services, and vulnerability hypotheses within 90 minutes — something that takes 8 hours manually.

Strategic close: T3MP3ST shifts security teams from reactive patching to proactive, continuous discovery. The coordinated-disclosure pipeline means findings go to vendors before attackers find the same bugs — a structural advantage that compounds over time.

CAVEATS

1. Swarm exploitation is unvalidated (significant risk) The 90.1% XBEN pass@1 and 8/10 CVE-Zero results came from single-agent ReAct loops, not the full 8-operator swarm. The Exploiter, Infiltrator, Exfiltrator, and Ghost operators run the same engine as Recon but have no benchmark proving coordinated multi-agent exploitation works at scale. Mitigation: use single-agent mode for production assessments. Only experiment with swarm mode on isolated targets.

2. White-box analysis is Python-only (moderate risk) The source-code analysis operator only natively parses Python. If your stack is Go, Rust, Java, TypeScript, or C++, the white-box ingest pipeline cannot decompose it. The CVE-Zero results included 7 languages because the Recon engine used external tooling, not the built-in analyzer. Mitigation: supplement white-box analysis with language-specific SAST tools (Semgrep, CodeQL, SonarQube) and feed findings into T3MP3ST's Analyst for report generation.

3. Local agent timeouts cause false mission failures (minor risk) Complex targets with slow responses can trigger T3MP3ST's default timeout settings, causing the agent to abort an exploit attempt prematurely. The harness rejection only applies to the Cybench benchmark path — production missions do not enforce the same floor. Mitigation: set T3MP3ST_LOCAL_AGENT_TIMEOUT_MS=180000 and T3MP3ST_TASK_TIMEOUT_MS=300000 for production targets. Test on a known-slow endpoint before running a full mission.

4. No cloud, mobile, AD, or binary exploitation benchmarks (moderate risk) The cloud (AWS/GCP/Azure), mobile (Android/iOS), identity/AD, and binary/reverse-engineering domains are marked as roadmap or in-development. Cloud has IaC-misconfig scaffolding but no live exploitation benchmark. Mobile has static analysis only. AD and binary RE have no shipped modules. Mitigation: use T3MP3ST for web application, CTF, and embedded OSS targets only. For AD, cloud, or mobile assessments, use purpose-built tools (Impacket, Pacu, MobSF) independently.

SOURCES

{
  "url": "https://github.com/elder-plinius/T3MP3ST",
  "title": "elder-plinius/T3MP3ST — autonomous red teaming platform",
  "org": "elder-plinius (GitHub)",
  "type": "github",
  "finding": "T3MP3ST scores 90.1% pass@1 on XBOW's 104-challenge XBEN suite and 8/10 exact file/line/CWE on held-out post-cutoff CVEs",
  "stat": "90.1% pass@1 XBEN, 8/10 CVE-Zero exact file/line/CWE",
  "date": "2026-07-02"
}

{
  "url": "https://github.com/elder-plinius/T3MP3ST/blob/main/docs/COGNITIVE_ARCHITECTURE.md",
  "title": "T3MP3ST Cognitive Architecture",
  "org": "elder-plinius (GitHub)",
  "type": "official-docs",
  "finding": "v4.2 cognitive architecture removed all attack recipes and forced a 20-iteration minimum floor, raising solve rate above the hint-laden v3",
  "stat": "23/40 Cybench hint-free, v4.2 solved 10/18 vs 9/18 on v3.2 with hints",
  "date": "2026-05-28"
}

{
  "url": "https://cybersecuritynews.com/t3mp3st-security-framework/",
  "title": "T3MP3ST Security Framework With 35 Tools, Turns AI Coding Agents Into 0-Day Bug Hunters",
  "org": "Cyber Security News",
  "type": "news",
  "finding": "T3MP3ST turns Claude Code, OpenAI Codex, and Hermes into autonomous red-teaming operators without new API keys or cloud infrastructure",
  "stat": "35 built-in tools, 83 with full arsenal, 8-operator kill chain",
  "date": "2026-07-05"
}

{
  "url": "https://healsecurity.com/t3mp3st-security-framework-turns-ai-coding-agents-into-0-day-bug-hunters/",
  "title": "T3MP3ST Security Framework Turns AI Coding Agents Into 0-Day Bug Hunters",
  "org": "HEAL Security",
  "type": "news",
  "finding": "T3MP3ST framework enforces egress-scope containment and maps 8 operators to MITRE ATT&CK tactics and Cyber Kill Chain phases",
  "stat": "90.1% XBEN pass@1, 23/40 Cybench solved",
  "date": "2026-07-05"
}

{
  "url": "https://www.ac0.ai/en/field-notes/t3mp3st-autonomous-red-teaming-multi-agent-ai-security",
  "title": "T3MP3ST: AI That Tries to Break Your AI",
  "org": "AC0.AI",
  "type": "community",
  "finding": "T3MP3ST became the most-starred new project on GitHub in 2026 within days of launch; self-hosted red-teaming for AI products",
  "stat": "Most-starred new GitHub project in 2026",
  "date": "2026-07-05"
}

---

BLOG POST