T3MP3ST

T3MP3ST points a swarm of AI agents at a target and tries to break in, then writes up how. It automates the red-team loop, reconnaissance, exploitation, and reporting, across web apps, CTF challenges, source code, embedded systems, and smart contracts. Instead of asking for its own API keys, it drives coding agents you already run, Claude Code, Codex, or Hermes. AGPL-3.0 and free.

Getting it running is light: npm install, npm run server, and a web War Room interface comes up. What is behind that interface is the honest question. The recon operator is production-ready, but the headline, a coordinated multi-agent swarm chaining exploits end to end, is still largely scaffolded. The benchmark numbers (around 90 percent on a web-security challenge suite, most of a held-out CVE set matched) come from a single agent, not the swarm the name promises. To its credit, the repo ships a verify-claims command so you can re-derive them yourself.

This is for security people doing authorized work, pentesters, CTF players, researchers probing their own code, not a push-button tool for anything you do not own. Solo researchers and small security teams: worth a look as an AI-assisted recon and triage layer today, with the exploitation swarm as a promising work in progress. Treat the automation as a force multiplier for a human who knows what they are doing, not a replacement for one.

The catch is the gap between the pitch and the product. The recon works, the autonomous kill chain does not fully exist yet, and AGPL-3.0 means anything you build on top inherits that copyleft. Judge it on what runs today, not the roadmap in the README.