Everyone has heard the news about AI finding numerous critical vulnerabilities — over a thousand per month. Today, we’ll share a less common experience: how LLM is changing the speed of developing offensive tools we use for security assessment.
The integration of new techniques into the Mythic framework consists of two parts: routine (scaffolding code, hooking into Mythic’s tasking API, packaging the output) and creative (the techniques themselves, their selection and improvement).
Our experts decided to test whether Anthropic Opus 4.6 can automate the routine. We started with a failed attempt to solve the task with one-shot prompt — but ultimately we got what can be described as a factory for disposable C2 agents, generated in less than three hours.
Key achievements:
— Three-agent cycle: Orchestrator, Developer, Tester — each with their own clean context.
— Task decomposition: 50 new commands for Mythic in 4 hours by parallel orchestrators.
— Oracle harness: three levels of validation — from a mock server to live QA on a Windows target. We started with our own experiments, tested the SpecterOps approach, and ultimately combined both.
— Model comparison: Kimi K3, DeepSeek V4 Flash, Qwen 3.6 27B — who succeeded, who cheated, who deceived.
— From tasks to full-fledged agents: Go-implant, Python-container, HTTP C2-profile, 7 commands — from scratch to PASS on all tiers.
For more details on how this pipeline is built, why context is more important than model intelligence, and why the harness is the product — read Oleg Senko’s article “C2 agent factory: notes on LLM-generated offensive tooling”.
