Cybermes – AI Red Teaming Agent for Automated Penetration Testing

A new open-source project called Cybermes has entered the crowded field of AI-powered offensive security tooling, positioning itself as an enterprise-grade autonomous agent capable of running full penetration tests with minimal human oversight.

Released by developer Zyrexnn and hosted on GitHub, Cybermes now sits at version 2.0.0 following a major architectural overhaul that shifted its performance-critical components from Python to native Go binaries.

The tool has been described publicly as an “Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework” built around what its creators call the Hermes reasoning engine.

At its core, Cybermes automates the reconnaissance-to-reporting pipeline that human penetration testers traditionally handle manually. The agent performs attack surface discovery, authenticated vulnerability research, and exploit validation, then compiles its findings into polished executive reports without requiring an analyst to stitch results together by hand.

Cybermes – AI Red Teaming Agent

This mirrors a broader industry trend toward agentic AI red teaming, exemplified by Microsoft’s own AI Red Teaming Agent inside Azure AI Foundry, which likewise automates adversarial testing and generates attack success rate scorecards for generative AI systems.

Cybermes, however, targets traditional web applications and infrastructure rather than large language model safety testing, drawing on more than 50 bundled security skills covering IDOR and BOLA testing, authentication bypass playbooks, race condition detection, and injection matrices for SSRF and DOM-based XSS.

One of the more notable claims surrounding Cybermes is its “zero-false-positive gate,” a validation layer that reportedly requires deterministic HTTP proof, exact status codes, and a standalone reproducible Python proof-of-concept script before any finding is written into a report.

This design directly addresses a chronic pain point in automated scanning tools, which frequently flood analysts with unverified or speculative alerts that waste triage time.

To make this feasible at scale, the tool relies on a token-economy architecture: a native Go component called smart_pipe intercepts noisy terminal output from reconnaissance tools like katana and ffuf, filters out static asset clutter and 404 noise, and streams only high-signal results to the underlying reasoning model, reportedly cutting token consumption by 70 to 85 percent per scanning phase.

Once an assessment concludes, Cybermes automatically produces four deliverables in parallel: a markdown executive summary, a structured JSON metadata file for CI/CD pipelines, an interactive HTML dashboard, and a print-ready PDF report complete with CVSS v3.1 scorecards and color-coded risk badges.

The underlying toolchain wires together well-known open-source utilities including subfinder, httpx, nmap, nuclei, sqlmap, and dalfox, alongside a 48-pattern credential scanner and an offline knowledge base built from resources like PayloadsAllTheThings and HackTricks.

This kind of orchestration layer reflects a growing pattern across the AI red-teaming ecosystem on GitHub, where dozens of projects now bundle agent scan, MCP scan, and jailbreak evaluation capabilities into unified platforms.

Cybermes supports installation on Linux, macOS, Windows via PowerShell or WSL2, and Docker, with a Telegram bot gateway allowing operators to trigger assessments remotely.

Notably, the project is distributed under the PolyForm Noncommercial License 1.0.0, meaning commercial use is restricted, and its documentation explicitly requires that all testing occur only against authorized targets under a structured “Scope and Authorization” framing.

Security teams evaluating Cybermes should treat its zero-false-positive and reporting claims as vendor-stated until independently benchmarked, a caveat that applies broadly to the fast-moving category of autonomous AI red teaming tools now emerging alongside enterprise offerings from Microsoft and other major vendors.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC