Cybermes Emerges as Open-Source AI Agent for Automated Penetration Testing
Cybermes, a new open-source AI red teaming agent, automates the full penetration testing pipeline for web applications and infrastructure, aiming to reduce false positives with a deterministic validation layer.
A new open-source project named Cybermes has entered the rapidly growing field of AI-powered offensive security tools, positioning itself as an enterprise-grade autonomous agent capable of conducting full penetration tests with minimal human oversight. Version 2.0.0, recently released and hosted on GitHub, represents a significant architectural overhaul, with its performance-critical components rewritten in Go to enhance efficiency.
Developed by Zyrexnn, Cybermes is described as an "Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework." It is built around a proprietary reasoning engine called Hermes, designed to automate the entire reconnaissance-to-reporting pipeline traditionally handled by human penetration testers. The agent performs comprehensive attack surface discovery, authenticated vulnerability research, and exploit validation, culminating in the generation of polished executive reports without manual intervention.
This development aligns with a broader industry trend toward agentic AI red teaming. While Microsoft has introduced similar AI Red Teaming Agents for testing generative AI systems, Cybermes specifically targets traditional web applications and infrastructure. It integrates over 50 security skills, covering a wide array of vulnerabilities such as Insecure Direct Object References (IDOR), Broken Object Level Authorization (BOLA), authentication bypasses, race conditions, and various injection flaws like Server-Side Request Forgery (SSRF) and DOM-based Cross-Site Scripting (XSS).
A key feature highlighted by the Cybermes project is its "zero-false-positive gate." This validation layer reportedly requires deterministic HTTP proof, exact status codes, and a reproducible Python proof-of-concept script before any finding is included in a report. This approach directly addresses a common issue with automated scanning tools, which often produce a high volume of unverified alerts that consume valuable analyst time.
To manage the computational demands of its automated processes, Cybermes employs a token-economy architecture. A native Go component, smart_pipe, filters noisy output from reconnaissance tools like katana and ffuf, removing static asset clutter and irrelevant 404 responses. This process streams only high-signal results to the reasoning model, reportedly reducing token consumption by 70% to 85% per scanning phase.
Upon completion of an assessment, Cybermes automatically generates four distinct outputs: an executive summary in markdown format, a structured JSON file suitable for CI/CD pipelines, an interactive HTML dashboard, and a printable PDF report featuring CVSS v3.1 scorecards and risk badges. The tool orchestrates a suite of well-known open-source utilities, including subfinder, httpx, nmap, nuclei, sqlmap, and dalfox, alongside a credential scanner and an offline knowledge base derived from resources like PayloadsAllTheThings and HackTricks.
Cybermes supports installation across Linux, macOS, and Windows (via PowerShell or WSL2), as well as Docker. It also features a Telegram bot gateway, enabling remote triggering of assessments. Notably, the project is distributed under the PolyForm Noncommercial License 1.0.0, restricting commercial use, and its documentation emphasizes that all testing must be conducted against authorized targets within a defined scope.
While Cybermes presents a compelling set of features for automated penetration testing, security teams should approach its claims of zero false positives and advanced reporting with a degree of caution, as independent benchmarking is still needed. This caveat is particularly relevant given the rapid evolution of autonomous AI red teaming tools, which are increasingly competing with enterprise-grade solutions from major vendors.