Awesome Offensive AI Agentic Landscape

What it is

A continuously-updated GitHub landscape mapping the "offensive AI" ecosystem — AI pentest/red-team agents, offensive open-weight models, Agent Skills, MCP servers, papers, benchmarks, and commercial products (international + China). What the summary can't carry is its selection and risk framing, which is the reason to use it over just skimming star counts.

What it adds beyond the summary

Scope boundary. The page is explicitly about using AI to attack, not attacking AI systems. LLM-security topics (prompt injection, jailbreak) are out of the main thread — the maintainer even removed 9 such projects on 2026-09-07 (56→47), including promptfoo, garak, PyRIT, and vulnhuntr. If you came looking for LLM red-teaming tools, this is the wrong map.

Model selection warning. Do not treat every "security" model as offensive. The page flags that VulnLLM-R, Foundation-Sec, CyberSecQwen, Meta-SecAlign, and Titus are vuln-detection/reasoning/defense-aligned and will refuse or need jailbreaking. Only Group A (Qwythos, WhiteRabbitNeo/DeepHat, Lily, BaronLLM, CyberStrike-OffSec-35B, BugTraceAI-CORE-Ultra) are genuinely uncensored offensive cores.

Risk gradient across resource types — this is the actionable part for deployment decisions:

flowchart LR
  A[Agent Skills<br/>methodology/orchestration<br/>no embedded exploit] -->|low risk| C[still needs<br/>separate tools]
  B[MCP Servers<br/>wrap Metasploit/sqlmap/hashcat] -->|higher risk| D[isolated env +<br/>explicit authorization]

Skills carry no attack code and depend on tools you install separately; MCP servers directly wrap live offensive tooling and are called out as higher-risk, deploy-in-isolation-only.

Caveats

Star counts in the 1k–10k range are converted from GitHub's abbreviated display; 10k+ figures carry larger error. Rankings shift fast (strix overtook shannon, 41k→60.1k, on 2026-09-02) — treat it as a dated snapshot, not a stable reference.