Weaponizing the Coding Agents Already on Your Machine: An Architecture Deep Dive into T3MP3ST

Most autonomous security suites fail at the integration layer. They demand dedicated cloud infrastructure, require yet another set of expensive API keys, and ship with opaque evaluation metrics that crumble under independent scrutiny. The T3MP3ST Security Framework, created by researcher elder-plinius, circumvents this entire tax by treating your local AI coding agents as modular execution engines for offensive security operations.

Instead of provisioning fresh model endpoints, T3MP3ST functions as an open-source orchestration layer that turns agents like Claude Code, Codex, or Hermes into autonomous red-team operators. Point it at a target, and it runs tool-augmented execution loops across the entire cyber kill chain from initial recon to post-exploitation without demanding additional API spend.

+-----------------------------------------------------------------------+
|                         T3MP3ST WAR ROOM / CLI                        |
|                     (Mission Target & Scope Rules)                    |
+-----------------------------------+-----------------------------------+
                                    |
                                    v
+-----------------------------------------------------------------------+
|                    LOCAL AGENT ORCHESTRATION LAYER                    |
|             (Claude Code / Codex / Hermes / Local Ollama)              |
+-----------------------------------+-----------------------------------+
                                    |
          +-------------------------+-------------------------+
          |                                                   |
          v                                                   v
+-----------------------+                           +-------------------+
| EGRESS CONTAINMENT    |                           | ARSENAL ENGINE    |
| Scope Enforcement     |                           | 35 to 83 Tools    |
| (Hard Refusal Boundary)                           | (Human Gates)     |
+-----------------------+                           +-------------------+

The Architecture of "Keyless Warfare"

The core premise of T3MP3ST rests on what the documentation terms "keyless warfare." Traditional automation frameworks hook directly into provider APIs via custom SDK calls. T3MP3ST instead hooks into your existing, authenticated interactive agent sessions.

The framework provisions a central "War Room" web UI and CLI interface. When an operator defines an engagement, T3MP3ST feeds structured tasks, target data, and tactical goals directly to the local agent runtime. The underlying LLM acts strictly as the cognitive loop: reasoning over state, parsing intermediate outputs, and selecting appropriate tool execution vectors.

Egress-Scope Containment

Autonomous offensive agents present an obvious risk: runaway scope creep. An unconstrained tool loop handed broad OSINT or scanning capabilities will inevitably drift toward third-party infrastructure.

T3MP3ST addresses this via hardcoded egress-scope containment. Network-touching binaries and subroutines intercept target arguments before execution. If an address, domain, or route resolves outside the explicitly authorized target boundary, the framework rejects the command at the orchestration boundary. This isolation ensures that autonomous execution chains cannot bleed into unauthorized public hosts.

The 8-Operator Framework

T3MP3ST organizes operational capabilities around an 8-operator architecture. Each operator is mapped directly to MITRE ATT&CK tactics and classic kill-chain phases:

Operator	Phase	MITRE ATT&CK	Function
Recon	Reconnaissance	TA0043	OSINT, network discovery, asset enumeration
Scanner	Discovery	TA0007	Vulnerability scanning, fingerprinting
Exploiter	Initial Access	TA0001	Exploitation, payload delivery
Infiltrator	Lateral Movement	TA0008	Post-exploitation, privilege escalation
Exfiltrator	Collection / Exfil	TA0009/10	Data exfiltration, credential harvesting
Ghost	Persistence	TA0003	Persistence, defense evasion, cleanup
Coordinator	Command & Control	TA0011	Mission control, orchestration
Analyst	Analysis	,	Pattern analysis, reporting

Operational Realities and the Tool Arsenal

The framework ships with 35 integrated utilities out of the box, expandable to 83 distinct capabilities when enabling the T3MP3ST_FULL_ARSENAL configuration. Because unconstrained automated exploitation poses severe operational risks, high-impact utilities such as Metasploit and Hydra remain locked behind explicit, human-in-the-loop approval gates.

It is critical to distinguish between the architecture's current state and its long-term roadmap. The Recon engine and the single-agent ReAct exploitation loop are fully stable and proven. Downstream operators like Exploiter and Infiltrator execute the same fundamental tool-reasoning loops as Recon, but fully coordinated, multi-operator swarm exploitation across long horizons remains experimental and unproven at scale.

Verified Benchmarks: Auditing the Claims

Vendor claims in the automated security space are notorious for relying on self-reported, closed-loop telemetry. T3MP3ST diverges from this by making every performance metric recalculable from committed data using a single local command: npm run verify-claims.

The framework evaluates against three primary benchmark suites:

Benchmark Suite	Key Result	Technical Context
XBEN (104-challenge black-box suite)	90.1% pass@1 (gpt-5.5)	XBOW self-reported 85% on the same suite. All results scored against committed flag oracles rather than self-asserted completions.
Cybench (40-task academic suite)	23/40 (58%) hint-free, single-run pass@1 (Opus 4.8)	Focuses on unassisted single attempts. Graded directly against committed flag oracles (compared to Anthropic's 76.5% pass@10).
CVE-Zero (10 real 2026 CVEs, held-out, 7 languages)	Single agent ID'd 8/10 vulns with exact file, line, and CWE; found all 10 overall.	All vulnerabilities sourced post-model training cutoff to eliminate data contamination and memorization.

A vital engineering caveat: these numbers reflect the execution of an optimized single-agent ReAct loop, not the full 8-operator swarm. Swarm-level multi-agent coordination remains in active development and is not yet reliable for autonomous exploitation runs.

Surface Attack Matrix

T3MP3ST categorizes target surfaces into discrete operational tiers based on current framework maturity:

Domain	Surface Coverage	Implementation Status
Web Applications	Modern apps, APIs, auth logic, OWASP Top 10	✅ Stable (Validated by 90.1% XBEN pass@1)
CTF Challenges	Wargames, cyber ranges, structured flags	✅ Proven (Validated by 23/40 Cybench score)
Source Code Auditing	White-box source review, SAST vuln identification	✅ Proven (CVE-Zero: 8/10 exact line/CWE hits) ⚠️ Ingestion engine remains experimental
Robotics / OT / Embedded	Firmware extraction, robotics, OSS ICS/SCADA	✅ Active coordinated discovery pipeline
Network Infrastructure	Network recon, stack fingerprinting	✅ Recon stable · ⚠️ Lateral movement and privesc experimental
Supply Chain	Dependency audit, unattended installs	⚠️ Functional (Identified CWE-829 in held-out data)
Smart Contracts	DeFi protocols, Solidity sources	⚠️ Experimental (Targeted at reproduction rather than novel 0-day discovery)
Cloud (AWS/GCP/Azure)	Cloud misconfigurations, IAM topologies, serverless	🚧 In Development
Mobile (Android/iOS)	Application logic, mobile attack vectors	🚧 In Development
Identity / AD	Kerberos tickets, pass-the-hash, AD domain structures	🚧 In Development
Binary / RE	Memory corruption, ROP chains, payload synthesis	🚧 In Development (Requires specialized execution tooling)

Deployment and Local Model Execution

Getting the orchestration server and War Room running requires minimal bootstrap overhead:

bash
# Clone and install dependencies
npm install

# Start the War Room server
npm run server
# War Room dashboard mounts at http://127.0.0.1:3333/ui/

Once loaded, access the Settings view within the Web UI to link your active local agents (Claude Code, Codex, Hermes). You can then assign targets through plain-text tasking prompts submitted to Op Admiral.

BYOK and Offline Local Configurations

For standard API consumption, pass provider credentials directly via environment variables:

bash
export OPENROUTER_API_KEY=your_key_here
# Alternative providers:
# export VENICE_API_KEY=...
# export ANTHROPIC_API_KEY=...
# export OPENAI_API_KEY=...

For air-gapped environments or local testing, T3MP3ST supports completely offline, local LLM backends via Ollama, LM Studio, or vLLM:

bash
# Start a local Ollama instance with Llama 3
ollama serve && ollama pull llama3

# Configure local endpoints
export TEMPEST_LOCAL_BASE_URL=http://localhost:11434/api
# If utilizing LM Studio: export TEMPEST_LOCAL_BASE_URL=http://localhost:1234/v1
export TEMPEST_LOCAL_MODEL=llama3

# Set default routing to the local engine
npx tempest config
# Select: "Change default provider" -> local

T3MP3ST implements tool calling over standard text prompting. Because of this design, local models without native JSON function calling can still drive the full tool arsenal reliably.

To audit all underlying performance claims against committed oracle data:

bash
npm run verify-claims

Operational Boundaries

T3MP3ST is distributed under the AGPL-3.0 license without warranty. It is built strictly for authorized security assessments, academic research, and defensive hardening. Executing attack payloads or reconnaissance sweeps against systems without explicit, prior written consent violates international computer fraud statutes. Operators are solely responsible for setting strict egress parameters and adhering to established rules of engagement.