AI-Enabled Attack Infrastructure: What Nine Agentic Pentest Frameworks Expose by Default

Over the past several months, our team at Threat Landscape has been tracking a quieter shift in offensive tooling: a wave of open-source frameworks that wrap large language models around reconnaissance, exploitation, and post-exploitation workflows. These projects are marketed as autonomous pentest agents, but many are also being deployed on public VPS instances and used as attack infrastructure. The distinction matters for defenders, because the same defaults that make these tools easy to launch also make them easy to find.

We tested nine of the most visible projects in this category — HexStrike AI, Cairn, CyberStrikeAI, RedAmon, PentAGI, Shannon, Strix, PentestGPT, and ARTEX — using their documented deployment paths. The question we set out to answer was simple:

Question: If one of these frameworks is deployed on a VPS, what listener does it open that defenders can identify?

For each project, we recorded the listening services, default bind addresses, TLS and authentication posture, and the artifacts left on the host and on the wire. This post shares those observations with the defender community so that network defenders, incident responders, and threat intelligence teams can identify and block this infrastructure before it is used against them.

The focus is deliberately defensive. We are publishing defaults, fingerprints, and detection guidance, not exploitation instructions. Where a project is safe by default, we say so; where a default exposes an unauthenticated service, we show what that looks like from the outside. The goal is to shorten the time between a suspicious VPS appearing in your telemetry and someone knowing what it is.

Scope and method

We deployed each project from its public repository using the documented quick-start or compose file, on a clean Linux VPS with no additional hardening. We then inspected listening sockets, process trees, container labels, generated certificates, and outbound traffic. We did not point any of these tools at third-party systems. The matrix below summarizes the default posture; the sections that follow give the specific ports, headers, files, and behaviors that make each project identifiable.

TL;DR matrix

Rule of thumb from this dataset: the newer "agent platform" projects (PentAGI, Shannon, Strix, PentestGPT) default to loopback binds or no listener; the "tool-server" projects (HexStrike, Cairn, CyberStrikeAI, ARTEX) and RedAmon bind 0.0.0.0 out of the box and are trivially fingerprintable.

1. HexStrike AI — the worst offender

One listener: Flask tools API on 0.0.0.0:8888, plain HTTP, zero authentication.

• Bind hardcoded: hexstrike_server.py:17289 — app.run(host="0.0.0.0", port=API_PORT).
• Port: hexstrike_server.py:98 — env HEXSTRIKE_PORT, default 8888.
• Config trap: HEXSTRIKE_HOST / API_HOST (:99) is defined but never used — it only appears in the startup banner (:198). Setting it to 127.0.0.1 does nothing.
• No authentication anywhere across 156 routes, including POST /api/command (arbitrary command exec, :9137) and POST /api/python/execute (:14498). Deployed as documented ⇒ internet-reachable unauthenticated RCE.
• Runtime secondary listeners: OWASP ZAP daemon on 0.0.0.0:8090 via POST /api/tools/zap (:14326–14340); ChromeDriver on loopback (no CDP port). mitmproxy code exists but is dormant.

Detection fingerprints

• GET /health → {"status":"healthy","message":"HexStrike AI Tools API Server is operational","version":"6.0.0"} plus a ~100-tool inventory (each health check runs which <tool> ×100 — visible subprocess burst).
• Outbound UAs: HexStrike-HTTP-Framework/1.0 (Advanced Security Testing), HexStrike-BrowserAgent/1.0; MCP client uses default python-requests with a /health retry burst.
• Local: hexstrike.log, /tmp/hexstrike_screenshot_*.png.
• No Dockerfile/compose — deployment is bare python3 hexstrike_server.py, so ss -tlnp shows a Werkzeug dev server on 8888 owned by python.

2. Cairn — open FastAPI, no auth

One listener: FastAPI on TCP 8000, plain HTTP, no authentication.

• Compose binds 0.0.0.0: docker-compose.yaml:9 ("8000:8000"), command cairn serve --host 0.0.0.0 (:23).
• Bare-metal CLI default is safer: 127.0.0.1:8000 (cairn/src/cairn/cli.py:17-18).
• Full unauthenticated read/write/delete of all projects; /docs, /redoc, /openapi.json left enabled (server/app.py:21-26).
• Hidden exposure: dispatcher worker containers run with network_mode: "host" (dispatcher/runtime/containers.py:51-58) on a Kali image with passwordless sudo — anything an agent opens binds straight onto the VPS host stack.
• Dispatcher mounts /var/run/docker.sock (docker-compose.yaml:31) — root-equivalent host credential.

Detection fingerprints

• uvicorn server header + openapi.json with "title":"Cairn", "description":"Fact-graph based collaborative exploration protocol", "version":"0.2.1".
• UI <title>Cairn</title>; localStorage keys cairn.localPrefs.
• Containers cairn-server / cairn-dispatcher / cairn-dispatch-<project_id>; image ghcr.io/oritera/cairn-worker-container:latest.
• Behavior: healthcheck GET /projects every 10s; dispatcher polls /projects every 3s.
• No TLS anywhere; storage is a single SQLite file (no DB creds exist).

3. CyberStrikeAI — exposed panel + optional C2 farm

Main listener: Gin web UI/API on 0.0.0.0:8080 (internal/config/config.go:2376-2377; config.example.yaml:16-18).

• Auth exists (session + RBAC; login rate-limit 10/min), but the login page and /api-docs are public. Admin password is randomly generated at first boot and printed to console (internal/security/auth_manager.go:59-89) — no default password.
• TLS self-signed by default with CN=CyberStrikeAI — a high-confidence network fingerprint (internal/app/main_server_tls.go:32-86; config.example.yaml:25,32).
• Optional MCP server: 127.0.0.1:8081/mcp, disabled by default; token auto-generated at first boot.
• Built-in C2 listeners (runtime, operator-created): http_beacon/https_beacon (paths /check_in, /tasks, /result, /upload), websocket (/ws, CheckOrigin allow-all), tcp_reverse (magic bytes CSB1, optional unauthenticated raw shell if allow_legacy_shell: true). Default bind 127.0.0.1 but trivially set to 0.0.0.0. Failed beacon auth returns a disguised generic 404 — that body is itself a fingerprint.
• Route surface includes /api/webshell/exec and a host WebSocket terminal /api/terminal/ws.

Detection fingerprints (outbound UAs): CyberStrikeAI/1.7.4 (FOFA/ZoomEye/Quake/Shodan), Mozilla/5.0 (compatible; CyberStrikeAI-WebShell/1.0), cyberstrike-ai/1.0 (LLM calls). Host artifacts: process cyberstrike-ai, config.yaml, data/conversations.db, tmp/c2, beacon curl loop with X-Implant-Token, <title>CyberStrikeAI</title>.

4. RedAmon — exposed by default (0.0.0.0 × 3)

Base docker-compose.yml publishes on all interfaces:

• Runtime bonus: a spawned Ollama container publishes 0.0.0.0:11434 via docker-py (recon_orchestrator/local_llm_manager.py:283-284).
• Loopback-only host publishes: 5432 (Postgres), 7474/7687 (Neo4j), 8010 (recon orchestrator), 8000/8002–8005 (MCP SSE servers), 8013/8014 (msf/hydra progress), 4040 (ngrok API), 8015 (tunnel manager), 8016 (terminal PTY WS), 8888 profile capture (mitmproxy).
• Credentials: installer (redamon.sh:1925-1971) generates keys with openssl rand -hex 32 (fail-closed), but compose fallbacks are changeme (AUTH_SECRET:-changeme, :1124-1126) and legacy compose files use postgres/redamon_secret. GVM boots admin/admin before rotation. MCP tokens are minted with prefix rdmn_mcp_.
• The hardened nginx overlay (tooling/deploy/single-host/) re-binds everything to loopback and closes 4444 — but a bare docker compose up republishes 3000/8090/4444 on 0.0.0.0 (documented footgun at compose/docker-compose.prod.yml:18-21).

Detection fingerprints: <title>RedAmon</title>, OpenAPI title="RedAmon Agent API", /docs+/health exposed, container names prefixed redamon-, networks redamon/pentest-net, X-Orchestrator-Key / rdmn_mcp_ tokens, SSE MCP endpoints at /sse.

5. PentAGI — careful defaults, noisy runtime

• Main UI/API: compose default 127.0.0.1:8443 (HTTPS, self-signed) (docker-compose.yml:32-33); README tells users to expose it for VPS access. The Go binary standalone defaults to plain HTTP 0.0.0.0:8080 (backend/pkg/config/config.go:79-81).
• TLS fingerprint: auto-generated self-signed cert with O=PentAGI / CN=localhost / SAN pentagi.local (scripts/entrypoint.sh:20-42) — near-conclusive.
• Unauthenticated endpoints: GET /api/v1/info (returns provider/guest JSON), GraphQL playground, Swagger UI titled "PentAGI Swagger API".
• Default creds: [email protected] / admin (forced password change); scraper basic-auth someuser/somepass; Langfuse admin P3nTagIsD0d; Neo4j devpassword; cookie signing salt literally salt.
• Ephemeral exposure: each agent flow spawns a Kali worker container publishing 2 TCP ports in 28000–30000 with host bind 0.0.0.0 (backend/pkg/docker/client.go:405-426; DOCKER_PUBLIC_IP defaults to all interfaces). A VPS running flows sprays listeners across that range.
• Beacon: POSTs an install summary (UUID, version, providers) to update.pentagi.com every 3h — strong outbound detection signal.
• Optional stacks (loopback): Grafana 3000, OTel 4318/8148, Langfuse 4000, Neo4j 7474/7687, Graphiti 8000; loopback pgvector 5432, exporter 9187, scraper 9443. Optional pprof on :7777 if enabled (unauth, /profiler/).
• Runs as root with the host Docker socket mounted.

6. Shannon — loopback-only Temporal

• Only listeners: Temporal dev server — gRPC 127.0.0.1:7233 and Web UI 127.0.0.1:8233 (docker-compose.yml:11-12; identical in apps/cli/infra/compose.yml). No TLS, no auth — but loopback-only, so invisible off-host unless the operator edits the mappings (docs suggest accessing the UI via http://<wsl-ip>:8233).
• Worker containers publish zero ports (apps/cli/src/docker.ts:424-528); headless Chromium uses pipe transport, no CDP port. BUT workers run --security-opt seccomp=unconfined and get host.docker.internal:host-gateway — from a compromised worker, the host's loopback Temporal (which has no auth) is reachable.
• No DB/redis — Temporal uses embedded SQLite. No default credentials at all.
• Fingerprints: container names shannon-temporal, shannon-worker-<8hex>; labels shannon.workspace, shannon.task-queue; images keygraph/shannon, temporalio/temporal:1.7.0; task queues shannon-<8hex>; report artifacts Security-Assessment-Report.pdf.

7. Strix — no persistent listener by default

• The agent itself never listens. The only host-side server is the optional report viewer: strix view (or in-TUI launch) — Python ThreadingHTTPServer, default 127.0.0.1 ephemeral port, plain HTTP; --host 0.0.0.0 is explicitly supported (strix/interface/viewer/server.py:562-593).
  • Fingerprint: Server: StrixViewer/1.0 header (server.py:149), cookie strix_viewer_session_<port>, auth = token in URL query string.
• In-sandbox: Caido MITM proxy binds 0.0.0.0:48080 with --allow-guests inside the sandbox container (containers/docker-entrypoint.sh:20,41-47); Docker backend republishes it on host 127.0.0.1 (strix/runtime/docker_client.py:244-247), but with STRIX_DOCKER_SANDBOX_NETWORK or the e2b backend it's reachable on the container IP with only a guest token.
• The sandbox image ships a MITM root CA with fixed subject CN=Testing Root CA, O=Security Testing and an empty PKCS#12 password — a striking host/IR artifact.
• Transient listeners: OAuth callback 127.0.0.1:1455 during strix auth login chatgpt; payment bridge on random loopback port.
• Outbound: telemetry on by default (PostHog phc_7rO3…, Scarf gateway), OpenRouter attribution headers HTTP-Referer: https://strix.ai, X-Title: Strix; sandbox image ghcr.io/usestrix/strix-sandbox:1.4.0, labels strix-run-id.

8. PentestGPT — no listener at all

• Pure CLI. Zero socket.bind/listen/HTTPServer/Flask/FastAPI in production code; the MCP tool-server runs over stdio only. Verified exhaustively; the only server in-tree is a loopback test fixture.
• Deployment-level: container-internal 127.0.0.1:3456 (Claude Code Router proxy, not published); transient host 1455/tcp socat relay during one-time make docker-login. No EXPOSE, no ports: in compose.
• Detection is therefore outbound/host-based: SDK-default UAs (OpenAI/Python, Anthropic/Python) carrying distinctive prompt strings ("You're an excellent cybersecurity penetration tester assistant.", PTT tree template); pentestgpt container, pentester user with passwordless sudo, volumes pentestgpt-claude/pentestgpt-codex/ccr-config; logs/pentestGPT.log; .env with provider keys; ~/.claude/oauth_token.

9. ARTEX — open console + embedded MITM proxy

Go pentest system (module Autumn-27/artex) with embedded Next.js UI, PostgreSQL backend, and a built-in go-mitmproxy traffic recorder.

Main listener: web console + JSON API + SSE on :8787 → 0.0.0.0, plain HTTP.

• Flag default ":8787" — bare :port in Go binds all interfaces (cmd/artex/main.go:55, main.go:117-128).
• Compose publishes "8787:8787" on the host's public interface (docker-compose.yml:31-33).
• Auth posture: first run requires POST /api/auth/init to set the admin password (bcrypt, then 403 forever — server/auth.go:158-207); login user hardcoded ARTEX; JWT HS256 with a random persisted key (<basedir>/jwt.key); but until setup is done, GET /api/auth/status reveals an unconfigured instance and the UI serves a setup page to anyone. Optional HTTP Basic Auth gate (realm Restricted) covers everything including /api/health if enabled.
• ~200 routes under /api/…: tasks, schedules, assets, traffic, intercept-rules, proxy-pool, workspace file manager, update/rollback, repeater. Real-time is SSE, not WebSocket.

Second listener: embedded MITM proxy (go-mitmproxy v1.9.2) on 8788.

• Bare-metal default 127.0.0.1:8788 (cmd/artex/main.go:57; empty disables it), but the Dockerfile CMD overrides to :8788 → 0.0.0.0 in-container (Dockerfile:47); compose republishes it loopback-only on the host (127.0.0.1:8788:8788).
• Generates a self-signed MITM CA at data/traffic/_ca/mitmproxy-ca-cert.pem on first start and injects it into agent shells (SSL_CERT_FILE/CURL_CA_BUNDLE) and Playwright (server/manager.go:557-562) — a freshly trusted go-mitmproxy CA on a host is a strong ARTEX indicator.
• Plus an always-on, credential-free loopback forward proxy on a random port (server/forward_proxy.go:34-44) for hot-swappable egress routing — not remotely reachable.

Support infra: PostgreSQL 16 (network-internal in compose; install.sh local mode publishes 5432 on 0.0.0.0; bench compose uses network_mode: host but is missing its Dockerfile/.env). SQLite for traffic index. DB DSN defaults sslmode=disable. No TLS anywhere in the app — nginx reverse proxy is the documented TLS mode. No gRPC/WebSocket; mcphttp/llmhttp/guard/intercept are outbound/in-process only.

Detection fingerprints

• Routes: GET /api/health → {"ok":true} (deliberately fingerprint-free), /api/auth/status (reveals unconfigured state), JWT-protected /api/version; cookie/param artex_token.
• Outbound UAs: artex-selfupdate (GitHub release checks to RuoJi6/ARTEX), artex-egress-probe/1.0, artex-enrich/1.0.
• UI title "ARTEX — 自主渗透测试控制台" (LLM-driven autonomous pentest console); ASCII "ARTEX" startup banner.
• Docker: image ruoji6/artex:latest, EXPOSE 8787 8788, base python:3.12-slim + Node 22 + Playwright chromium + nmap; files data/traffic/_index/index.sqlite, log prefixes [traffic], [proxy], [auth].
• Docker-compose bench mode (network_mode: host) would put 8787/8788/5432 directly on the host's public interfaces.

Defender's consolidated detection playbook

Fast network triage on a suspect VPS

ss -tlnp        # look for: 8888, 8000, 8080, 3000+8090+4444, 8443, 7233/8233, 48080, 1455, 28000-30000
curl -k -s https://127.0.0.1:8443/api/v1/info           # PentAGI
curl -s http://127.0.0.1:8888/health                    # HexStrike
curl -s http://127.0.0.1:8000/openapi.json | grep Cairn # Cairn
curl -skI https://127.0.0.1:8080 | grep -i subject      # CN=CyberStrikeAI
curl -s http://127.0.0.1:8787/api/auth/status           # ARTEX (unconfigured = fresh deploy)
docker ps --format '{{.Names}}' | grep -Ei 'pentagi|shannon|strix|redamon|cairn|pentestgpt|cyberstrike|caido|artex'

Highest-signal indicators

1. HexStrike /health JSON on 8888 with version 6.0.0 — also means unauthenticated RCE is live.
2. TLS cert CN=CyberStrikeAI or O=PentAGI / SAN pentagi.local — self-signed branding.
3. Server: StrixViewer/1.0 header; Cairn openapi.json title.
4. TCP 4444 with msf handler + 3000/8090 together = RedAmon.
5. Ephemeral listener clusters in 28000–30000 appearing during runs = PentAGI workers.
6. Outbound beacons: update.pentagi.com (3h), PostHog/Scarf (strix-cli), LLM UA strings CyberStrikeAI/…, HexStrike-…/1.0, artex-selfupdate / artex-egress-probe/1.0 / artex-enrich/1.0, HTTP-Referer: https://strix.ai.
7. Host artifacts: MITM CA CN=Testing Root CA, O=Security Testing in trust stores (Strix); freshly generated go-mitmproxy CA at data/traffic/_ca/ (ARTEX); processes hexstrike_server.py, caido-cli --allow-guests, cyberstrike-ai, strix, pentestgpt; docker labels strix-run-id, shannon.workspace; image ruoji6/artex with exposed 8787/8788.

Risk ranking (exposure if deployed on a public VPS)

1. 🔴 HexStrike AI — 0.0.0.0:8888, no auth, RCE endpoints. The HEXSTRIKE_HOST setting silently does nothing.
2. 🔴 RedAmon — UI + agent API + msf catcher on 0.0.0.0 unless the nginx overlay is used correctly.
3. 🔴 Cairn — 0.0.0.0:8000 with no auth; host-networked Kali workers compound it.
4. 🔴 ARTEX — 0.0.0.0:8787 plain HTTP; unconfigured instances leak a setup page to anyone; MITM CA generation is a loud host-side indicator.
5. 🟠 CyberStrikeAI — exposed but authenticated; self-signed TLS branding; operator can add internet-facing C2 listeners (incl. an unauth raw-shell mode).
6. 🟢 PentAGI — loopback by default, but worker ports leak onto 0.0.0.0 and the README pushes operators to expose 8443.
7. 🟢 Shannon — loopback-only; risk is operator edits + auth-less Temporal reachable from seccomp-unconfined workers.
8. 🟢 Strix — nothing persistent; exposure requires explicit strix view --host 0.0.0.0.
9. 🟢 PentestGPT — no inbound service by design.

What this means for defenders

The common thread is not sophistication; it is convenience. Projects that bind to 0.0.0.0 and skip authentication do so because it makes the first run easier, and that convenience survives into production when operators follow the README on a public VPS. For defenders, the practical response is to treat these ports and fingerprints as a watchlist, not a blocklist of product names. Attackers rename containers, change ports, and put reverse proxies in front of panels. The durable signals are the ones that are expensive to change: default TLS subjects, API response schemas, user-agent strings, host artifacts, and the shape of outbound beacon traffic.

We recommend three steps. First, scan your own external estate for the default ports and TLS subjects in this report, then verify whether any instance is intentionally exposed. Second, add the highest-signal network and host indicators above to detection engineering, with alerting on new listeners in the ephemeral ranges and on the outbound beacons described above. Third, if you discover an exposed instance that is not yours, preserve what you can and report it through your normal abuse or law-enforcement channel rather than interacting with it.

We are sharing this research because the defender community sees the same infrastructure from the outside, often without context. If your team has additional fingerprints or corrections, we would like to hear them.

This research is provided for defensive purposes. It describes default configurations and observable artifacts only; it is not a guide to deploying or operating these tools against third parties.