---
title: "The Swarm Is the Branding. One Agent in a Loop Did the Work."
pubDatetime: 2026-07-05T00:00:00.000Z
description: "Pliny's T3MP3ST turns the AI coding agent you already run into an offensive-security harness, and posts 90.1% on XBOW's own benchmark. Its own receipts say the eight-operator swarm scored none of it."
tags: [ai-security, red-teaming, llm-agents, offensive-security, benchmarks, open-source, 2026, 2026-q3, 2026-07]
---
> [!tldr] TL;DR
> [T3MP3ST](https://github.com/elder-plinius/T3MP3ST), released Friday by Pliny the Liberator, wraps an offensive-security arsenal around the AI coding agent already running on your machine: no API key, no cloud tenant, AGPL-3.0. It claims 90.1% pass@1 on XBOW's 104-challenge XBEN suite (XBOW self-reports 85%), 23/40 hint-free on Cybench, and 8/10 real 2026 CVEs pinned to exact file, line and CWE. Every number recomputes from committed data with `npm run verify-claims`, and those same committed files admit the eight-agent swarm scored none of them: a single ReAct loop did. Read the receipts before the README, because they are the reason this release is worth taking seriously.

Pliny the Liberator shipped an offensive-security framework on Friday, and the most interesting sentence in it is a disclaimer.

[T3MP3ST](https://github.com/elder-plinius/T3MP3ST) presents as a multi-agent red-teaming platform: eight operators (Recon, Scanner, Exploiter, Infiltrator, Exfiltrator, Ghost, Coordinator, Analyst) mapped onto MITRE ATT&CK tactics, arranged around a browser "War Room". Then you reach the benchmark table and find this, in bold: "These ran a **single-agent ReAct loop, not the 8-operator swarm.** The swarm is framework architecture; it is not what scored these numbers."

Frameworks do not usually undercut their own name in their own README. This one does it three times.

## Keyless warfare

The design bet is that you already pay for a hacker. T3MP3ST ships no model and asks for no key. It drives Claude Code, Codex or Hermes over their existing session, or any OpenAI-compatible endpoint you host yourself (Ollama, LM Studio, vLLM). Tool calls are driven over plain text, so local models without native function-calling still run the arsenal. `npm install && npm run server` puts a War Room on `127.0.0.1:3333`, where you describe a target in English to an orchestrator called Op Admiral and it launches.

That makes it a meta-harness, a wrapper that turns a general coding agent into a specialised one, which is [the category the industry still lacks a shared word for](/posts/agent-harnesses-standard). It ships 35 tool adapters by default and 83 behind an opt-in flag, with the genuinely dangerous drivers (metasploit, hydra) held behind a human-approval gate. Egress-scope containment is on by default: once a mission target is set, networked tools refuse off-scope public hosts with `SCOPE DENIED`.

## The numbers, and the arithmetic underneath them

The headline is 90.1% pass@1 (Wilson-95: 86.2–92.9) on XBEN, [XBOW's](https://xbow.com/) own 104-challenge black-box suite, where XBOW self-reports about 85%. Cybench comes in at 23/40 hint-free single-run, which the README is careful to distinguish from Anthropic's 76.5% pass@10. And a held-out set of ten real CVEs disclosed in 2026 across seven languages, where a single agent named the exact file, line and CWE on eight.

That last one is the load-bearing claim, because post-cutoff bugs cannot be memorised. The committed ground truth makes it checkable. One sample is [CVE-2026-44974](https://github.com/advisories/GHSA-36hh-x5p5-jgc8) in `hapijs/content`, published 27 May: a CWE-436 parameter-smuggling bug in `lib/index.js` that lets an attacker bypass upload filters with duplicate parameters. The agent gets one file to look at and has to land on lines 18, 19 or 121.

Then read `bench/cve-zero/results/v2-holdout-findings.json`, built the day before launch on Opus 4.8 at xhigh effort, and the marketing gets quieter. A hit means top-3 findings by severity, matching file, plus either CWE family or line ±15. The swarm gets 10/10 where solo gets 8/10, and the file explains why in its own caveats field: "swarm runs 10 specialists vs solo 1 (recall edge) ... **NOT** a coordination-beats-solo proof." Ten specialists pooling findings with no skeptic filter will always out-recall one generalist. That is more shots on goal, and [we already know what a single agent in a dumb loop can do](/posts/ralph-wiggum-technique).

The haystacks deserve a look too. Nine of the twenty committed samples carry a `source_note` reading "Subset: only the `X` package (containing the vuln file) was copied into source/". The `node-tmp` sample is one file. `hashicorp/nomad` is forty. Finding a path traversal in a directory someone has already told you contains a path traversal is a real skill. It is a different skill from finding one in a repository.

I can make that argument only because the data is in the repo. That is the actual contribution here.

## Forty-eight hours of strangers hardening an attack tool

The public launch build landed Friday afternoon. By Sunday night, pull requests had arrived from at least eight outside contributors, and the security ones are pointed.

A contributor going by `mane` filed nine of them in a single day. [PR #12](https://github.com/elder-plinius/T3MP3ST/pull/12) found that `EvidenceVault.updateFinding()` could set `verifiedAt` and `verifyGate` directly, meaning a caller could stamp its own finding as verified without a gate ever running. For a project whose entire pitch is receipts over vibes, an evidence vault that accepts forged verification is the funniest possible bug. [PR #11](https://github.com/elder-plinius/T3MP3ST/pull/11) removed wildcard CORS from the local `/api/events` SSE stream and stopped `/api/tools/execute` trusting a caller-supplied `target` override to scope its approvals.

> [!warning]
> Two more, [#26](https://github.com/elder-plinius/T3MP3ST/pull/26) and [#27](https://github.com/elder-plinius/T3MP3ST/pull/27), fixed the same class of leak in opposite directions: white-box source context passed raw file bodies into model prompts, and `exportToMarkdown()` copied evidence excerpts verbatim into reports the HTTP server hands out. A tool that harvests credentials for a living was piping them into its own outputs. If you cloned this over the weekend, update.

## Why it matters

Agentic security tooling has a credibility problem, and it is mostly self-inflicted. Vendors post a percentage, decline to publish the transcripts, and ask you to believe the orchestration diagram did it. T3MP3ST posts a percentage and hands you the command that recomputes it, plus a status table that marks its own swarm as experimental and unreliable.

The capability question stands regardless. This is an AGPL framework, explicitly built to put zero-day hunting in reach of people without the training, running on a coding agent millions of developers already have open, and its own worked example is a real CVE published in May. Egress containment and approval gates are the right defaults, and a determined operator flips both. The [lethal trifecta](/posts/ai-agent-security-lethal-trifecta) reads differently when the agent is holding a scanner on purpose.

Still: the honest version of a dangerous thing beats the dishonest version. Pliny built the honest version and then let strangers audit it in public for two days. Most of the industry does neither.

---

**Sources**

- [elder-plinius/T3MP3ST](https://github.com/elder-plinius/T3MP3ST) on GitHub, AGPL-3.0 (public launch build, 3 July 2026)
- T3MP3ST `bench/cve-zero/results/v2-holdout-findings.json` and `bench/cve-zero/samples/*/ground-truth.json`, the committed CVE-Zero receipts
- [PR #11](https://github.com/elder-plinius/T3MP3ST/pull/11), [#12](https://github.com/elder-plinius/T3MP3ST/pull/12), [#13](https://github.com/elder-plinius/T3MP3ST/pull/13), [#26](https://github.com/elder-plinius/T3MP3ST/pull/26), [#27](https://github.com/elder-plinius/T3MP3ST/pull/27) by `mane`
- [GHSA-36hh-x5p5-jgc8 / CVE-2026-44974](https://github.com/advisories/GHSA-36hh-x5p5-jgc8), `@hapi/content` parameter smuggling

**Coverage**

- Cyber Security News, ["T3MP3ST Security Framework With 35 Tools, Turns AI Coding Agents Into 0-Day Bug Hunters"](https://cybersecuritynews.com/t3mp3st-security-framework/) (5 July 2026)
- [Hacker News submission](https://news.ycombinator.com/item?id=48793403) (5 July 2026), which drew no discussion at all

**Related on this blog**

- [Ralph Is Five Lines of Bash. All the Bugs Are in the Improvements.](/posts/ralph-wiggum-technique). The other project whose single dumb loop keeps beating the orchestration
- [Agent Harnesses: A Standard for a Word Nobody Agrees On](/posts/agent-harnesses-standard). What to call a wrapper that turns a coding agent into something else
- [Three Indirection Steps From a Reverse Shell](/posts/ai-agent-security-lethal-trifecta). The trifecta, when the agent is armed deliberately
- [The Payload Was Never in the Package](/posts/ai-agent-skill-poisoning). Instructions as the attack surface