KittySploit Turns a Hostname Into a Local Attack Plan

KittySploit is an open-source pentest framework whose agent can take a hostname and drive a full exploit pipeline on a local model. Cybersecurity News on July 12, 2026, billed it as an AI pentest tool with more than 1,150 modules. The vendor site now claims more than 7,200, and the public usage guide shows how short the path from a name to exploitation can be.

The syndicated write-ups sold module counts and stealthy payloads. The second effect is quieter. Planning can stay on loopback, captured web traffic can be replayed into the agent, and a Windows installer is in the repo. Cloud AI safety filters never see the job. Neither do most Microsoft 365 and Defender logs.

A Metasploit-Style Console With a Local Brain

The GitHub org SIA-IOTechnology publishes KittySploit as a modular offensive console and C2 platform for pentesters, researchers, and red teams. The README describes a Metasploit-inspired prompt for scanning, modules, listeners, sessions, workspaces, and AI-assisted plans. A one-line curl installer is offered for Linux and macOS. Windows users get install\install.bat and python kittyconsole.py.

First launch asks for charter acceptance and database encryption. Inside the console, doctor checks the install. Operators can set a workspace, turn on scope, and allow a subnet before they scan. The project is MIT licensed. The README says the 1.x line is still changing and that new builds should be tested in a lab before an engagement.

KITTYSPLOIT PUBLIC FOOTPRINT

• GitHub stars: 609 on the main framework repo.
• Public forks: 97, which is also the number the vendor homepage repeats.
• License: MIT for the framework, with a paid reporting layer sold separately.
• Companion apps: a Flutter mobile pair flow, plus KittyProxy, KittyCosmic, KittyOsint, KittyProtocol, and KittyV8Debugger as separate projects.

That star count is early for a tool being compared with Metasploit. Rapid7’s 2025 Metasploit wrap-up, published January 5, 2026, listed 139 new modules in a single year and 66 contributors. Metasploit Framework 6.5 also added an MCP server so AI apps such as Claude or Cursor can call sixteen Metasploit tools. KittySploit is not the only project wiring models into a console. It is one of the few that defaults the example brain to a model you host yourself.

The Usage Guide Documents a Hostname-to-Shell Path

The README’s AI example is cautious. It calls a local llama3.1:8b model with --plan-only and --dry-run so the agent prepares a testing plan without launching intrusive actions. The detailed usage guide is less shy. It states that the agent runs a scan to exploit pipeline, and the first one-shot sample is kittysploit agent target.com --llm-local --llm-model llama3.1:8b, with no plan-only flag on that line.

Safety exists. It is a switch. Goals include recon and obtain-shell. Risk levels run read, active, intrusive, then destructive, and a higher approval includes the lower ones. --shell-hunter sits next to --approve-risk intrusive. The bulk scanner accepts --auto-exploit. Twenty-five bundled workflows cover web recon, API audit, cloud exposure, and an AD enum labeled safe. That is not hidden. It is in the same markdown file as the dry-run flags.

An 8B local model is a small brain for that loop. The xOffense multi-agent pentest paper on arXiv (posted September 16, 2025, revised April 27, 2026) used a fine-tuned Qwen3-32B and reported a 79.17% sub-task completion rate on AutoPenBench and AI-Pentest-Benchmark. PentAGI, another open agent system, also speaks Ollama, and its docs warn that hard pentest work wants a much larger context window. KittySploit makes the launch line cheap. It does not prove llama3.1:8b will chain a live, messy app the way a person would.

Port 11434 Is the New Paper Trail

KittySploit can use a local Ollama model to prepare a testing plan without automatically launching intrusive actions.

KittySploit README, SIA-IOTechnology, GitHub

That sentence is the privacy pitch. The agent talks to the Ollama chat API on port 11434 at 127.0.0.1 by default, so engagement notes are not supposed to hit OpenAI, Anthropic, or a hosted SOC copilot. Licensed testers with data-residency rules asked for this. Cloud models also refuse a lot of exploit wording. A local llama does not.

The same design leaves a hole that vendors watching Copilot or ChatGPT logs will not see. Zenity Labs wrote on June 30, 2026, that from March through May its honeypots saw operators point pentest agents at hijacked Ollama and LiteLLM backends. Ollama ships with no built-in auth on 11434. People bind it to 0.0.0.0. On March 20 a source pushed a 140,000-character Strix agent prompt at a live French auction site. The day before, another source loaded HexStrike AI’s 150-tool set, a stack now packaged in Kali Linux, onto a stolen Ollama instance.

KittySploit is not named in that write-up. The pattern is the same class of workload: an offensive agent whose brain is a local or borrowed model, with the full persona riding in the request body. If your detection story is “alert when staff paste exploits into ChatGPT,” this traffic never appears. The tell is a workstation or server speaking JSON to 11434, often with a huge tool list in the body.

How KittyProxy Feeds Captured Logins to the Agent

KittyProxy is the Burp-shaped piece. Operators bind it at 127.0.0.1:8080, point a browser at it, and intercept HTTP and HTTPS. The July coverage said the proxy auto-finds REST, GraphQL, and WebSocket endpoints and fires matching modules from that traffic. The usage guide is more specific about the agent hook. After you browse through the proxy, you can run the agent with --reuse-proxy-auth and --http-replay active, plus --approve-active-replay.

That is the time collapse. Classic web tests spend hours mapping APIs, copying tokens, and replaying calls by hand. Here the map is the proxy history, and the agent is told to reuse the session it already saw. Scope flags can still fence an engagement. They do not change the mechanics: once a cookie or bearer token is in the proxy, replay is a documented switch.

July posts that asked whether KittySploit replaces Metasploit and Burp Suite missed this split. The console copies Metasploit habits (use, set, run, sessions interact). KittyProxy is the traffic side. The agent sits on top of both. Replacement is the wrong word. The product is trying to be the glue, then to let an 8B model drive the glue.

Marketplace Logins Unlock Paid Exploit Modules

The homepage’s shot at Metasploit and Cobalt Strike is the marketplace. Modules and UI extensions install from a registry. Install and update need an account. Paid exploits and extensions are tied to that account, not to one laptop, so market buy then market install works on a second machine after login. Free items install with market install --all-free. GitHub repos and local folders with extension.toml can be installed too.

MARKETPLACE ARTIFACTS THE DOCS NAME

• Modules: exploits, auxiliary, scanners, and payloads that load with the usual use then run flow.
• Extensions: UI tools such as KittyProxy and KittyOsint, launched from the console or a generated script.
• Create templates: market create accepts types including exploit, payload, backdoor, browser_exploit, encoder, listener, and ui.
• Publish path: package locally with a dry run, then upload after login to a registry with a publish endpoint.

A catalog that large is a supply-chain surface. On July 22, 2026, a researcher wrote that a GitHub campaign was dropping a multi-stage JavaScript backdoor into third-party forks of pentest and AI tools, and named Kittysploit among the projects whose forks were in the blast radius. The original KittySploit repo was not described as compromised. The lesson is older than this tool. Community module trees get cloned, forked, and silently swapped. Microsoft already had to malicious npm packages stealing cloud secrets in a similar install-from-the-internet pattern. A pentest marketplace with paid exploits and a backdoor template type is the same class of trust problem, aimed at people who already have high privileges on client networks.

LOCAL LLM OFFENSE, BY DATE

1. September 16, 2025: xOffense is posted on arXiv as a multi-agent pentest system on a fine-tuned Qwen3-32B.
2. March 19, 2026: Zenity sees a HexStrike AI toolset aimed at a hijacked Ollama host.
3. March 20, 2026: a Strix agent prompt is aimed at a live third-party site through the same class of backend.
4. July 12, 2026: Cybersecurity News covers KittySploit as an AI framework with more than 1,150 modules and a Zig payload story.
5. July 22, 2026: a public note ties a GitHub backdoor campaign to forks of pentest and AI tools, including Kittysploit.

July coverage said payloads compile with a Zig 0.16 toolchain into dependency-free x64 polymorphic encoders meant to slip past EDR and WAF. Zig 0.16.0 is a real compiler release. The README that ships with the framework today does not mention Zig. A GitHub wiki snapshot listed 500 MB of disk for a Zig compiler install. Treat the EDR-bypass line as the wire’s claim until the current tree documents it in the same way it documents the agent flags.

What Windows Defenders See From Local Agents

Windows is a first-class install target, not an afterthought. The repo tells operators to clone, run the batch installer, and start the Python console. Listeners, reverse shells, XOR transforms on C2 streams, and a browser-server path for browser exploits are in the usage guide. If a blue team only watches outbound calls to OpenAI or to a Microsoft copilot endpoint, this job is invisible at the AI layer. The workstation talks to itself on 11434 and 8080, then to the target.

Useful signals are boring and local. A new Python tree plus a Zig compiler cache. Ollama bound off localhost. A proxy on 8080. A Flutter companion paired by QR, which the README says is read-only for monitoring. RPC on 8888 and an API on 5000, both supposed to require KITTYSPLOIT_API_KEY. That is not malware by itself. It is the same shape as a consultant laptop. The difference is that the agent can keep walking after the human goes to lunch, if someone passed --approve-risk intrusive.

Scope is the control the product actually ships. scope enable, scope allow ip, scope allow domain, and a rate limit sit in the usage guide because the authors know a hostname-only agent will wander. A reply under the syndicated July posts asked how the models keep planned paths ethical and inside scope. They do not, not by themselves. The model proposes. The flags allow. The charter is a first-run prompt, not an enforcement kernel. If an operator skips scope enable, the LLM has no extra conscience that Defender can query.

KittySploit Reports Costs €39.99 per Editor

The business split is now clearer than the July module-count story. The framework stays free and self-hosted. Money sits on KittySploit Reports, a browser-encrypted publishing layer that takes findings over an API and exports PDF, HTML, Markdown, Word, LaTeX, and JSON. The homepage prices it at €39.99 per editor per month, VAT included, with free viewer seats. Boutique firms are the named buyer: keep the MIT console, pay for the client PDF.

That split also answers the Metasploit comparison. Rapid7 still ships the huge public module tree and a Pro SKU. Cobalt Strike remains a licensed red-team C2. KittySploit is trying to be the open console with a store and a report upsell, plus a local model so the plan never leaves the laptop. GitHub activity is modest: 609 stars, 97 forks, 238 commits on the snapshot we pulled, wiki version 1.0.2. Spanish-language roundups and a few practitioner posts recirculated the GitHub UI into August. One low-engagement reply said AI-assisted attacks sound great until they fail in practice. That is the right pressure test for an 8B planner sitting on a 7,200-module claim.

The README’s last operational note is the one that still fits. Interfaces will move. Validate new versions in a controlled lab before anyone points the agent at a customer hostname, with or without the dry-run flag.