A new peer-reviewed security analysis reveals that 10 of 12 widely used agentic offensive security platforms can be fully exploited to compromise operators’ machines, even through sandboxed containers.
Researchers from Cracken published the first in-depth security audit of 12 open-source agentic red-team systems, exposing a class of systemic architectural vulnerabilities that allow adversaries to exfiltrate LLM API keys, establish persistent footholds, and achieve full remote code execution (RCE) on operator infrastructure.
The study, published June 23, 2026, evaluated tools including CAI, RedAmon, PentestAgent, DarkMoon, PentAGI, AIRecon, PentestGPT, METATRON, nebula, xalgorix, Artemis, and STRIX.
Agentic Red-Team Tool Flaws
The research team identified that the majority of tested agents share common design flaws rooted in overly permissive privilege models and weak component isolation.
Three agents, METATRON, Nebula, and Xalgorix, operate without an OS-level sandbox, meaning an initial compromise of the worker environment immediately translates into full host access.
Across the remaining tools, 10 of 12 agents were vulnerable to sandbox escape and host-level compromise, 11 of 12 exposed LLM provider API keys to exfiltration, and all 12 were susceptible to unbounded weaponization that completely bypassed implemented guardrail mechanisms.
The paper introduces a tailored five-stage kill chain specific to agentic red-team systems:
- Worker RCE via agent manipulation — The attacker stages a malicious but fully functional payload (e.g., a fake password-decryption utility called
pwcrypt) on a honeypot target. Without any prompt injection, the agent downloads and executes the binary, triggering a hidden memory corruption vulnerability that opens a reverse shell. - Privilege escalation — From the compromised worker container, attackers pivot to the orchestrator using shared writable Docker volumes or unauthenticated REST APIs exposed on the internal network.
- Persistence — Attackers trojanize application source files or inject malicious agentic “skills” into persistent databases, maintaining control across container restarts and new sessions.
- Sandbox escape — Excessive Docker capabilities such as
--network=host,--privileged, or mounted Docker sockets (/var/run/docker.sock) allow direct escalation to the host OS. - Host compromise — Full RCE on the operator’s machine is achieved, enabling installation, C2 activity, and further lateral movement.
A particularly alarming finding is the “agent-phishing” technique, a manipulation method that requires zero explicit prompt injection. Instead, it relies purely on environmental deception and adversarial reward hacking.
In testing across six frontier LLMs, including Claude Opus 4.8, GPT-5.5, Gemini 3.1 Pro, DeepSeek V4 Pro, GLM-5.1, and Kimi K2.6, the attack achieved a 97.8% success rate across 10 agents and three distinct honeypot payloads.
Every recorded failure was caused by LLM safety guardrails blocking task initiation outright, not by the agent detecting the malicious payload itself.
The Arxiv reveals a fundamental architectural flaw in the enforcement of existing guardrail mechanisms across all tested tools.
Every implementation applies policy checks exclusively at the orchestrator level, validating only LLM-generated tool-call arguments, while the actual commands executed in the worker environment bypass these checks entirely.
This means an attacker with shell access on the worker container can freely send network traffic to any target, including sensitive government domains, with zero intervention from the guardrail system.
Mitigations
The researchers propose a secure reference architecture built on a compromise-oriented threat model that assumes the worker will eventually fall under adversary control.
They recommend strict worker–orchestrator separation across OS, network, and filesystem layers, with no secrets stored in the worker environment. LLM API keys must reside exclusively in the orchestrator.
Guardrail enforcement must move to the OS level using kernel syscall filtering rather than LLM argument validation, and high-privilege tools like nmap should be confined to isolated containers exposed only through narrow, hardened APIs.
All worker network traffic must route through a policy-controlled egress proxy defined exclusively by the orchestrator to prevent unbounded weaponization.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
