Threat actors are already using AI to speed up recon, find vulnerabilities faster, and scale social engineering. The barrier to launching sophisticated attacks is dropping. Rapid7’s Red Team decided to do the same thing—but for defense.
Over the past year, they built a structured multi-agent system that follows their penetration testing methodology from start to finish: scoping, testing, validation, reporting. This isn’t a proof of concept. It’s production.
The system also ran as part of Anthropic’s Project Glasswing initiative, where they combined their architecture with Claude Mythos. The results in vulnerability analysis and exploit chain development were exceptional.
Why build it?
Penetration testing is labor-intensive. A huge chunk of every engagement is repeatable work: enumerating attack surfaces, tracing data flows, checking headers, formatting findings. The judgement calls—what to test next, whether something’s exploitable, what the business impact is—stay human. The goal was to offload the mechanical stuff to AI and keep people at the decision points that matter.
How it works
It’s not one monolithic agent. It’s a team of specialists coordinated by an orchestrator. The orchestrator doesn’t test anything—it assesses the current state, figures out what needs to happen next, and routes work to the right specialist. Specialist agents handle enumeration, code review, dynamic testing, and reporting. Each has defined inputs, outputs, and constraints.
The key insight? They reverse-engineered the architecture from their team’s daily task lists. Real to-do items became the spec: what repeats, in what order, where decisions branch, what triggers backtracking.
Scope decomposition
Throwing a whole engagement at an LLM at once produces shallow results. So they break the scope into chunks—individual components or feature areas—and each chunk flows through the full architecture independently. Depth over breadth.
Safety by design
Building an AI that can hack is easy. Building one that stays within boundaries is hard. Every action is validated against authorized scope. Dynamic tests get classified as destructive or non-destructive before execution. Destructive and ambiguous actions require human approval. The agent proposes; people decide.
The bottom line
Building offensive AI made Rapid7 better at defending the AI they ship. They now test their own AI products with the same architectural intuition—looking for routing decisions that can be subverted, gates that can be skipped, feedback loops that can be poisoned.
