Markdown

Agentic cybersecurity and system operations¶

Scope: the tools that put an LLM agent in the operator's chair for security and operations work. Two families sit here. Agentic cybersecurity covers agents that find, prove, and report vulnerabilities (autonomous pentesters, LLM red-teaming harnesses, MCP-wired offensive toolkits) plus the runtime that keeps a compromised or over-eager agent boxed in. Agentic system operations covers agents that investigate and resolve production incidents (AI SRE, agentic AIOps). Reference index page; the focused pages carry the detail. These agents are built on the agent loop and tools and function calling, and they inherit the whole agent security threat model.

The through-line: an agent that can run nmap, sqlmap, or kubectl is only as safe as the scope guard, the sandbox, and the verification gate wrapped around it. Every page here is read against its primary source at a pinned commit, with the core mechanism executed and asserted, not paraphrased from a README.

flowchart TB
  subgraph CYBER["Agentic cybersecurity"]
    PENTEST["Autonomous pentesters"]
    REDTEAM["LLM red-teaming"]
    MCP["MCP offensive toolkits"]
    OFFRUST["Offensive tooling craft"]
  end
  subgraph OPS["Agentic system operations"]
    SRE["AI SRE agents"]
    AIOPS["Agentic AIOps"]
  end
  subgraph RUNTIME["Runtime enforcement"]
    EBPF["eBPF network policy and observability"]
    SANDBOX["Sandboxing and isolation"]
  end
  CYBER --> RUNTIME
  OPS --> RUNTIME
  RUNTIME -.->|"contains"| CYBER

How to use this section¶

Pages here are per-technology pages: What it is, Why use it, When to use it (and when not), Architecture, then how to use, develop, maintain, and run each tool in production, then Failure modes and References. Every one names the exact repository, commit, and license it was examined at. Code and configs are reference templates; pin versions and validate before relying on them. Offensive tooling on this page is for authorized testing only: read each project's acceptable-use terms and get written authorization before pointing an agent at anything you do not own.

Agentic cybersecurity¶

Autonomous web pentesting with Shannon: a multi-agent, white-box pentester that reads your source, plans attacks, and reports only vulnerabilities it exploited, wired as a prerequisite DAG of pre-recon, recon, five vulnerability-class agents, five matching exploit agents, and a report agent.
Earned-verdict pentesting with ptai: an MCP-driven scanner whose findings are worthless until a machine oracle re-proves them N out of N, with a false-control twin that rejects any signal it cannot attribute to the payload. Verification buys precision, not catch rate.
Claude Code pentest subagents: 50-plus prompt-only Claude Code subagents for authorized offensive work, with a mandatory scope-guard block that every execution-capable agent must carry; the invariant is checked in CI and re-checked here against the repo.
Agentic pentest orchestration: PTT and CrewAI: two control models for autonomous pentest tools, the dynamic Pentesting Task Tree (GHOSTCREW) and the fixed sequential crew (TARS), and when a tree beats a pipeline.
LLM red-teaming with promptfoo: a declarative eval and red-team harness with plugins for harm categories and strategies that obfuscate an attack past shallow filters, scored by a grader rather than by the wrapper.
Offensive security tooling in Rust: the craft of building scanners, crawlers, and implants in Rust, from a book whose ch_02 scanner still compiles and whose .unwrap() still panics on a bad response, which ch_03 fixes with proper error propagation.

Runtime enforcement¶

eBPF runtime security with Cilium: identity-based network policy and Hubble observability as the containment layer under any agent that runs untrusted tools; label identity is not trust, so egress and L7 rules, not L3 alone, contain a matched-but-compromised peer.

Agentic system operations¶

AI SRE agents with OpenSRE: an open framework for incident-response agents that correlate logs, metrics, traces, and deploys, with reversible identifier masking before external LLM calls and a synthetic-incident RL environment to train against.

Adjacent operations pages already in this knowledge base cover the surrounding practice:

Agentic AIOps and autonomous operations: the taxonomy and control loop for operations agents.
Agentic incident management (OpsAgent): the incident-response agent pattern end to end.
STRATUS: transactional non-regression for SRE agents and SREGym: safety and evaluation for the same class of agent.
Agentic AI detection and response (ADR): the defensive counterpart that watches the agents themselves.

The safety spine¶

Nothing here is safe on its own. An offensive agent needs a declared scope and a hard-refusal list; an ops agent needs identifier masking and reversible actions; both need the sandbox. Read these alongside any tool on this page:

Agent sandboxing and isolation and the policy engine.
Risk-tiered human approval gates for anything that mutates a real system.
Cybersecurity agent evaluation for measuring whether any of it works.

References¶

OpenSRE (Tracer-Cloud): https://github.com/Tracer-Cloud/opensre
Shannon (Keygraph): https://github.com/KeygraphHQ/shannon
ptai / pentest-ai (0xSteph): https://github.com/0xSteph/pentest-ai
pentest-ai-agents (0xSteph): https://github.com/0xSteph/pentest-ai-agents
GHOSTCREW / PentestAgent: https://github.com/0xSojalSec/PentestAgent
TARS (osgil-defense): https://github.com/osgil-defense/TARS
promptfoo: https://github.com/promptfoo/promptfoo
Black Hat Rust: https://github.com/skerkour/black-hat-rust
Cilium: https://github.com/cilium/cilium