Skip to content
Submit incident
AII-1000-31303
ReportedReported by fewer than three independent publishers, with no official finding.Supporting sources are pending verification.

T3MP3ST open-source tool automates hacking via Claude Code

T3MP3ST, an open-source AI tool created by Plinius, reportedly automates penetration testing and hacking by coordinating specialized AI agents through Claude Code without requiring separate API keys. The tool achieved a 90.1% success rate in security testing and resolves vulnerabilities without human intervention, according to developers who describe it as democratizing offensive security beyond specialist circles.

11 July 2026 Β· Plinius Β· Security and cyberattacks
11 July 2026
AII-1000-31303
Quick facts
Category
Security and cyberattacks
Country
Spain
Date
11 July 2026
Drafted by
Raidu Incident Detection

What happened

Plinius released T3MP3ST on GitHub, an open-source tool that organizes hacking into specialized AI agents handling reconnaissance, scanning, exploitation, lateral movement, exfiltration and persistence.

T3MP3ST operates without requiring separate API keys, instead using existing authentication from Claude Code, Codex or Hermes.

The tool demonstrated a 90.1% success rate in 104 penetration testing exercises with obfuscated code, and resolved 21 of 40 academic security challenges using Claude Opus 4.8.

Index analysis

The creator stated the tool aims to democratize offensive security beyond specialist circles, making vulnerability discovery accessible without specialized credentials.

Only the initial reconnaissance agent is fully operational; later agents for exploitation and infiltration exist as structures without autonomous AI motors.

Classification

Category
Security and cyberattacks
Industry
Digital security
Country
Spain
Harm status
Potential harm
Intent
Intentional
Timing
Unknown
Failure modes
Agent misaction, Jailbreak
AI systems
Claude Code, T3MP3ST

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident