AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK framework. The tool generates tailored incident response scenarios based on user-selected threat actor groups and your organisation's details.
# AttackGen
AttackGen is a cybersecurity incident response testing tool that leverages the power of large language models and the comprehensive MITRE ATT&CK and ATLAS frameworks. The tool generates tailored incident response scenarios based on user-selected threat actor groups, AI attack case studies, and your organisation's details.
## Table of Contents
- [Star the Repo](#star-the-repo)
- [Features](#features)
- [Releases](#releases)
- [Requirements](#requirements)
- [Installation](#installation)
- [LangSmith Setup](#langsmith-setup)
- [Data Setup](#data-setup)
- [Running AttackGen](#running-attackgen)
- [MCP Server](#mcp-server)
- [Agent Skills](#agent-skills)
- [Usage](#usage)
- [Security Best Practices](#security-best-practices)
- [Contributing](#contributing)
- [Licence](#licence)
## Star the Repo
If you find AttackGen useful, please consider starring the repository on GitHub. This helps more people discover the tool. Your support is greatly appreciated! ⭐
## Features
- Generates unique incident response scenarios based on chosen threat actor groups or ATLAS case studies.
- Allows you to specify your organisation's size and industry for a tailored scenario.
- Supports MITRE ATT&CK Enterprise, ICS (Industrial Control Systems), and ATLAS (Adversarial Threat Landscape for AI Systems) frameworks.
- Displays a detailed list of techniques used by the selected threat actor group or case study.
- Create custom scenarios based on a selection of ATT&CK or ATLAS techniques.
- Use scenario templates to quickly generate custom scenarios based on common types of cyber incidents, including AI/ML-specific attack patterns.
- Generate **AI Insider Threat Scenarios** - incident response exercises in which a frontier AI agent deployed inside your organisation behaves as an insider threat, based on the threat model from [*Actions Speak Louder Than Tokens: An Insider Threat Model for Frontier AI Agents*](https://ai-insider-threat.matt-adams.co.uk). Scenarios are shaped by the agent's deployment archetype (autonomy level), threat category, STRIDE threats, and an optional free-text scenario seed.
- AttackGen Assistant - a chat interface for updating and/or asking questions about generated scenarios, with a direct route back to the page the scenario came from.
- Guided setup: every page shows the same **Setup** sidebar, lists every outstanding requirement in one readiness summary, and keeps **Generate** disabled until the workflow is ready.
- Results persist for the session: each scenario page keeps its own latest result, its captured inputs and its downloads across reruns and navigation, and only an explicit **Regenerate** or **Clear result** replaces or removes it.
- Long scenarios come with a compact summary and section navigation, including shortcuts to the injects, success criteria, metrics, artefacts and rules of engagement a facilitator runs the exercise from.
- Capture user feedback on the quality of the generated scenarios.
- Downloadable scenarios in Markdown format.
- Use the OpenAI API, Anthropic API (Claude models), Google AI API, Mistral API, Groq API, or any custom OpenAI-compatible endpoint (Ollama, LM Studio, Azure OpenAI, OpenRouter, etc.) to generate incident response scenarios. All providers are routed through [LiteLLM](https://github.com/BerriAI/litellm) behind a single internal wrapper, so adding a new model is a one-line change.
- Available as a Docker container image for easy deployment.
- Optional integration with [LangSmith](https://docs.smith.langchain.com/) for powerful debugging, testing, and monitoring of model performance.
- Secure credential management using .env file for API keys and secrets.
## Releases
### v0.17
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| Apply Assistant Refinements to the Downloads | - Changes Reach the Files: The Assistant's chat used to refine a conversation only, so the scenario and Detection & Response downloads never changed. A new **Apply changes to downloads** button rewrites them from the conversation, in a dedicated model call that returns the complete revised document. In **Scenario + Detection & Response** mode it revises both, each given the other's current text so they stay aligned.<br><br>- The Reference Section Stays Exact: A Detection & Response apply rewrites only the narrative. The deterministic detection and mitigation reference drawn from the ATT&CK data is carried over byte for byte. The Navigator layer is not regenerated and is captioned as reflecting the original scenario's techniques.<br><br>- Safe to Try: An empty reply from the model is refused with no changes made. The scenario page and the Assistant both caption a refined result with the time of the last apply, and **Revert to original** restores the scenario and narrative together.<br><br>- Download Where You Edit: The Assistant now offers the same **Download Scenario** and **Download Detection & Response** buttons as the scenario page.<br><br>- One Conversation per Scenario: Each chat belongs to the scenario it is about, so a newly generated scenario starts a fresh conversation, and the whole history stays visible after an apply. |
| Guided, Resilient Scenario Workflow | - Readiness Before the Click: Every page now lists what is still missing — the page's own selection first, then any incomplete Setup field — and keeps **Generate** disabled until nothing is outstanding, so a click is never spent discovering a validation error.<br><br>- Options Before the Action: The AI-enhanced adversary and purple-team toggles sit above **Generate**, with the purple-team option stating that it makes a second model call.<br><br>- Confirm Before You Spend: A one-line summary of the framework, organisation profile, selection and modifiers is shown before generation starts.<br><br>- Results That Survive Navigation: Each page keeps its own latest result, the inputs that produced it and its download names for the session — open the Assistant and come back and the scenario, its Navigator layer and its Detection & Response report are still there. Editing the form leaves the result in place with a note that your selections have moved on; **Regenerate** and **Clear result** are explicit actions.<br><br>- Find Your Way Around a Long Scenario: A compact summary and section index sit above the full Markdown, with shortcuts to injects, discussion questions, success criteria, metrics, artefacts and rules of engagement.<br><br>- Useful Empty States: With no scenario, the Assistant links to all three ways to create one; with one, it names the scenario it is discussing and links back to the page that generated it. |
| Recover From a Failed or Slow Narrative | - Keep What Worked: If the optional purple-team narrative fails or is stopped, the base scenario, its downloads, the Navigator layer and the deterministic Detection & Response reference stay fully usable, with a message saying what failed.<br><br>- Retry Only What Failed: **Retry purple-team narrative** reruns the narrative alone, with no second base-scenario call, and merges it into the Detection & Response view and download. A failed base scenario offers its own retry using the inputs captured at **Generate**.<br><br>- A Timer That Keeps Moving: The elapsed time now advances while waiting for a model's first token, so a long wait no longer looks like a hang. |
| Clearer Failures When Techniques Won't Load | - Failures Reported as Failures: A threat group whose technique lookup fails is no longer shown as a group with no techniques, and Custom Scenarios no longer hides its technique picker and asks you to select techniques when the list failed to load.<br><br>- A Next Step, Not a Dead End: Both blockers now say what you can do about the failure. |
| Accessibility and Leaner Copy | - Keyboard and Screen-Reader Friendly: Icon-only controls have meaningful accessible names, form labels are unique, and keyboard order and focus are visible and logical. The layout no longer overflows horizontally at phone width, and the empty theme-colour console warnings are gone.<br><br>- Checked in CI: Real-browser smoke tests for console hygiene and accessibility now run on every pull request and gate the release image.<br><br>- Less to Read: The scenario pages no longer repeat the pre-flight summary in a second expander or explain their own state management. |
| Model Registry Refresh | - Latest Models: The model list is refreshed against each provider's current docs — **GPT-6 Astra** heads the OpenAI list, **Claude Opus 5.5**, **Claude Opus 5** and **Claude Fable 5.1** join the Anthropic one, and Google gains **Gemini 3.8 Flash** alongside **Gemini 3.5 Flash Lite**, with one prior generation kept for continuity in each case. Anthropic's list now leads with **Claude Opus 5.5** — the sidebar's default when you haven't picked one — rather than the pricier Fable 5.1.<br><br>- Removed Retired Entries: Dropped ids the providers have superseded or shut down — Claude Opus 4.7 and 4.8 (more than one Opus generation back once Opus 5.5 lands) and Groq's `llama-3.3-70b-versatile` and `llama-3.1-8b-instant` (both shut down 16 Aug 2026) — so the sidebar can't offer a model that only errors once you press **Generate**. Groq's open-weight reasoning tier is now `qwen/qwen3.8-27b`.<br><br>- Temperature Rule Kept Honest: `supports_temperature` is set from each Anthropic model's actual sampling behaviour — every Claude from 4.7 on rejects a custom temperature, and Haiku 4.5 remains the only listed model that accepts one. The test guarding this now fails when a new Anthropic entry omits the flag, rather than only when someone sets it by hand. |
| Platform & Security Housekeeping | - Python 3.11 Minimum: Python 3.10 is no longer supported. LiteLLM 1.98.0 and later import a typing feature that only exists from 3.11.<br><br>- Patched Base Image: The Docker image is rebuilt on a current `python:3.14-slim`, clearing the Debian base-image CVEs flagged by Trivy, including three critical ones in `perl-base`.<br><br>- Real Errors From Failed Calls: `tenacity` is now declared, so a failed model call reports the provider's actual error (for example an invalid API key) instead of an instruction to install `tenacity`.<br><br>- Feedback Stays With Its Scenario: A rating is recorded against the run that produced the scenario on screen, never another page's latest run. |
<details>
<summary>Earlier releases (v0.16 and older)</summary>
### v0.16
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| Base-Scenario-First Generation | - Scenario Before the Wait: Generation now runs in phases — the base scenario renders first with its **Download Scenario** and **Download ATT&CK Navigator Layer** buttons already live, and the optional purple-team narrative streams in afterwards. If that second pass is slow, or you don't need it, the scenario is usable straight away rather than withheld until everything finishes.<br><br>- Inputs Frozen at Generate: Each run works from a snapshot taken the moment you press **Generate**, so changing the sidebar mid-run can't half-rewrite the scenario being produced.<br><br>- Honest Progress: A running elapsed-time label and named phases — preparing inputs, generating the base scenario, building the deterministic exports, generating the purple-team narrative — show where a long run has actually got to. |
| Neutral, Dead-End-Free Selectors | - Only Options That Work: The threat-group and case-study selectors now offer only the choices that actually produce a scenario, so a selection can no longer lead to a dead end.<br><br>- Natural Ordering: Groups sort in natural numeric order, so APT3 comes before APT28 and APT30 rather than being sorted as text and landing between them. |
| Shared Setup Sidebar on Every Page | - Set Up Once: Provider, model, framework, industry and company size now live in a single shared **Setup** sidebar on every scenario page — Threat Group, Custom and AI Insider Threat — instead of being re-entered on each one.<br><br>- Survives Navigation: Non-secret selections persist as you move between pages and are mirrored to the URL, while API keys are deliberately kept out of the query string. |
| Platform & Security Housekeeping | - MCP on the 2.x SDK: The MCP server has moved to the `mcp` 2.x SDK.<br><br>- Newer Base Image: The Docker image is now built on `python:3.14-slim`.<br><br>- CI Gates Rather Than Warns: The security scans now fail the build on findings instead of only reporting them — pip-audit and Bandit gate, Trivy no longer miscounts pip's vendored SBOM as installed packages, and the actionable image CVEs are cleared. GitHub Actions have moved off the Node 20 runtime and Dependabot now tracks the workflow actions themselves. |
### v0.15
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| Evaluation Environment Escape Preset & Scenario Seed | - Rehearse a Specific Incident: A new AI insider-threat template rehearses an evaluation agent reaching real systems from an environment assumed to be isolated — forcing containment, credential rotation, third-party notification and evidence preservation. It covers the July 2026 disclosures of eval agents escaping their sandboxes, where the isolation boundary was *assumed* rather than enforced.<br><br>- Templates Now Reach the Prompt: Quick-start templates previously only pre-filled the page's widgets and never influenced the generated scenario. They now carry a narrative `brief` and the `required_decisions` the Discussion Questions must force, both threaded into the prompt — so a template produces a usable timed tabletop rather than a grab-bag of questions. This splits them into two classes: the six original **archetype** templates set decisions only, so the model invents the premise and re-running one yields a fresh exercise for the same threat profile; **incident** templates also set a brief, pinning the situation.<br><br>- Free-Text Scenario Seed: An optional seed box on the AI Insider Threat page steers the narrative on any scenario. Selecting a template pre-fills it, and you can edit it or write your own from scratch.<br><br>- Taxonomy Extended to 27 Threats / 6 Categories: Adds a sixth threat category (**Containment & Third-Party Impact**) and four STRIDE threats the exercise turns on — `S5` reusable workload credential replay, `R4` agent-side telemetry suppression, `I5` third-party & downstream compromise, and `E5` containment boundary assurance failure. AttackGen now *extends* the published threat model rather than mirroring it.<br><br>- Templates Usable Over MCP: `get_ai_insider_prompt` and `generate_ai_insider_scenario` accept `template=` and `scenario_seed=`, and `list_ai_insider_options` returns each template with the selections and brief it applies — so a client can pick a preset on merit and call with just a template, industry and company size. Previously the template names were listed but no tool accepted one. |
| attackgen-tabletop Skill: AI Insider-Threat Path | - A Second Exercise Path: The [Agent Skill](https://github.com/mrwadams/attackgen/blob/main/skills) now builds a tabletop from the AI insider-threat model as well as from a MITRE kill chain. Pick a quick-start template (or a deployment archetype and threat categories) and it turns `get_ai_insider_prompt`'s payload into an MSEL.<br><br>- Same Shape, Different Spine: The exercise keeps the same six sections, but the kill-chain table becomes an agent profile and STRIDE threat scope, the detection scorecard is judged against the deployment archetype's detection posture — so the rows that *wouldn't* fire become the finding — and the template's required decisions become mandatory discussion questions.<br><br>- Path Chosen for You: The skill's description now triggers on rogue-agent phrasing, so asking for an "AI insider threat tabletop" reaches the right path. An external actor with AI-accelerated tradecraft stays on the MITRE path.<br><br>- Response, Not Exploit: Both paths are explicitly bounded to rehearsing the decisions a response team must make — no exploit code, payloads or real unpatched vulnerabilities — and the AI path attributes agent behaviour to configuration, access and objective rather than human motive. |
| Fix: MCP AI-Insider Prompts Dropped the Agent Capabilities | - Same Template, Same Prompt: The frontier-agent capability block — the benchmark-grounded lines that make an AI insider scenario credible — was omitted from every `get_ai_insider_prompt` / `generate_ai_insider_scenario` call that didn't name `capabilities` explicitly. No template supplies them, so the argument fell through to empty and the prompt substituted a generic "assume a capable frontier coding agent" line, while page 3 sent all four for the same template.<br><br>- Defaults Now Match the App: Omitting `capabilities` applies the full set, as the page's multiselect does. Passing `[]` still leaves them unspecified, so the deliberate opt-out is unchanged. |
| Fix: Anthropic Claude 4.7+ scenario generation | - Every Claude Model Works Again: Claude 4.7 and later reject any sampling `temperature`, returning `BadRequestError: 'temperature' is deprecated for this model`. Four of the five listed Anthropic models — Fable 5, Opus 4.8, Sonnet 5 and Opus 4.7 — could not generate a scenario on any page; only Haiku 4.5 worked.<br><br>- Gated Per Model, Not Per Provider: The temperature rule was previously routed from the provider, which cannot express a provider whose models disagree. `ModelInfo.supports_temperature` now marks the models that reject one, so Haiku 4.5 keeps its configured temperature while its siblings omit it. OpenAI stays a provider-level rule (every current chat model is a reasoning model), and unregistered models — local Ollama / LM Studio endpoints — still receive a temperature. |
### v0.14
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| MCP Server for Agentic Clients | - Scenario Generation as Tools: A new FastMCP server (`mcp_server.py`, official `mcp` SDK) exposes AttackGen to agentic clients over stdio, so an assistant like Claude Code or Claude Desktop can pull MITRE data and generate scenarios without the Streamlit UI.<br><br>- Two Tiers: **Data tools** (`list_threat_groups`, `list_case_studies`, `get_kill_chain`, `get_detection_report`, `get_navigator_layer`, `list_ai_insider_options`, `get_ai_insider_prompt`) make no LLM call and need no API key — they return structured MITRE data and, where useful, a ready-to-run prompt, so they're safe to host over HTTP. **Generate tools** (`generate_threat_group_scenario`, `generate_custom_scenario`, `generate_ai_insider_scenario`) take a bring-your-own-key config and return finished Markdown — keep these on local stdio.<br><br>- Shared Implementation: The server reuses the same headless `core/prompts.py` builders and `core/attack_data.py` loaders the Streamlit pages use, so scenarios match the app rather than drifting. Launch with `python -m mcp_server` or the `attackgen-mcp` console script. |
| attackgen-tabletop Agent Skill | - Facilitator-Ready Tabletops: A new [Agent Skill](https://github.com/mrwadams/attackgen/blob/main/skills) builds on the MCP data tools to turn a MITRE ATT&CK/ATLAS threat group or case study into a full IR tabletop / MSEL — scenario narrative, phase-mapped kill chain, timestamped injects, NIST SP 800-61 discussion questions and a detection-coverage scorecard.<br><br>- Runs on the Caller's Model: The skill supplies the exercise craft while the MCP server supplies the data, so it runs on the client's own model with no additional API key.<br><br>- Two Output Formats: Delivered as Markdown (default) or a self-contained, print-friendly HTML report. |
| Assistant Refines the Detection & Response Output | - Purple-Team Editing: The AttackGen Assistant can now refine the **Detection & Response** narrative, not just the scenario. When a scenario is generated with the 🟣 Purple-team narrative toggle (Threat Group / Custom pages), an **Editing:** selector appears on the Assistant page so the chat can target either the scenario or the defender's walkthrough — previously the Assistant only had the scenario text.<br><br>- Combined Editing Mode: A third **Scenario + Detection & Response** target refines both together, so a cross-cutting change — a different industry, threat actor, technique or timeline — is applied consistently across the attacker's scenario and the defender's narrative rather than being made twice and drifting apart.<br><br>- Deterministic Facts Untouched: Only the LLM narrative is a refinement target; the local STIX detection join is never LLM-edited. Each editing mode keeps its own chat history, and the combined pass is tagged `purple_team_narrative` in LangSmith. |
| Simpler Model Registry | - One Less Thing Per Model: The `max_completion_tokens` kwarg and the reasoning-model temperature rule are now routed from the **provider** rather than a per-model `uses_max_completion_tokens` flag — every current OpenAI chat model uses them, so the flag duplicated a fact the provider key already captured. Adding a new OpenAI model stays a one-entry edit to `MODELS`, with no extra flag to remember.<br><br>- No Behaviour Change: An internal simplification only — the wrapper builds identical LiteLLM kwargs for every current model. |
### v0.13.1
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| Fix: OpenAI GPT-5.x scenario generation | - Correct Reasoning-Model Handling: OpenAI's GPT-5.x reasoning models reject any sampling `temperature` other than their default, so every GPT-5.x generation was failing with `BadRequestError: 'temperature' does not support 0.7 with this model`. AttackGen no longer sends a custom temperature to these models, while other providers keep the configured value. |
| Model registry refresh | - Latest Models: Refreshed the model list against each provider's current docs — **OpenAI GPT-5.6** (Sol / Terra / Luna tiers), **Claude Fable 5** and **Claude Sonnet 5**, with one prior generation kept per provider for continuity.<br><br>- Removed Stale Entries: Dropped models that providers have superseded or are retiring — notably Groq's `qwen3-32b` (shut down 17 Jul 2026) and Mistral's Magistral Medium — so the sidebar can't offer a model that errors on selection.<br><br>- Added a fast/cheap Groq tier (`llama-3.1-8b-instant`). |
### v0.13
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| Purple-Team Mode: Detection & Response | - Defensive Companion: Every Threat Group and Custom scenario now surfaces a **Detection & Response** section that joins each of the scenario's techniques to the MITRE ATT&CK detection strategies, analytics, log sources and mitigations already in the shipped data — turning a red-only narrative into a purple-team exercise ("here's the attack, and here's exactly what your SOC should have seen").<br><br>- No LLM Call for the Facts: The detection section is a **local data join**, not a model call — so the analytics, log sources and mitigations it lists are the real, current MITRE content rather than model guesses. It's offered as its own `..._detection.md` download alongside the scenario and layer.<br><br>- Log Sources to Enable: A per-scenario roll-up lists the distinct log sources the detections read (e.g. `WinEventLog:Security (EventCode=4624)`), so a SOC can see at a glance what telemetry the exercise assumes.<br><br>- Optional Purple-Team Narrative: A per-page **🟣 Purple-team narrative** toggle adds a second model pass that walks the scenario stage by stage from the defender's side — what should fire, what the analyst sees, how to respond — grounded strictly in the detections and mitigations above (no invented detections).<br><br>- ATLAS Aware: ATLAS scenarios list mitigations (ATLAS has no detection strategies yet) and say so, rather than showing nothing. |
| MITRE ATT&CK v19.1 & Latest ATLAS Data | - Updated Frameworks: MITRE ATT&CK Enterprise and ICS data refreshed from v18.1 to **v19.1**, and MITRE ATLAS refreshed to the latest release, so generated scenarios reflect the current tactics, techniques and case studies.<br><br>- Refreshed Group Lists: The threat-group dropdowns are regenerated from the v19.1 bundles (174 Enterprise and 14 ICS active groups). Groups MITRE has revoked or merged upstream (e.g. APT34 → OilRig, UNC2452 → APT29) no longer appear, while newly tracked groups such as MirrorFace do.<br><br>- More ATLAS Case Studies: The ATLAS case-study library grew to 57 (17 incidents, 40 exercises).<br><br>- Repeatable Refresh: A new `scripts/generate_groups.py` regenerates the group mappings from the shipped STIX bundles, complementing the existing ATLAS case-study script — so the next refresh is a scripted step rather than manual curation. |
| ATT&CK Navigator Layer Export | - Downloadable Layer: Every generated scenario on the Threat Group and Custom Scenario pages now offers an ATT&CK Navigator layer (`.json`) alongside the Markdown download, so a scenario's techniques can be visualised, annotated and shared in the ATT&CK Navigator. To view it, download the layer and open it via **Open Existing Layer → Upload from local** in the Navigator.<br><br>- All Three Matrices: The correct Navigator domain is set automatically per matrix — upload Enterprise and ICS layers to the [MITRE ATT&CK Navigator](https://mitre-attack.github.io/attack-navigator/), and ATLAS layers to the [ATLAS Navigator](https://mitre-atlas.github.io/atlas-navigator/) fork. (An ATLAS layer won't load in the ATT&CK Navigator, or vice versa, as each only recognises its own domain.)<br><br>- Techniques Stay Visible: Scored sub-techniques automatically expand their parent and technique IDs are surfaced in the layout, so the scenario's highlighted techniques are immediately apparent rather than hidden in collapsed rows.<br><br>- No Extra LLM Call: The layer is a local serialisation of the techniques already selected for the scenario — no additional model call or external lookup.<br><br>- Descriptive Download Filenames: Scenario and layer downloads are now named after the threat actor / custom scenario and matrix with a generation timestamp (e.g. `AttackGen_APT29_Enterprise_20260714-153045.md`), so saved files are meaningful and don't collide across scenarios. |
### v0.12
| What's new? | Why is it useful? |
| ----------- | ----------------- |
| AI Insider Threat Scenarios | - New Scenario Type: A dedicated page generates incident response tabletop exercises in which a frontier AI agent deployed inside your organisation behaves as an insider threat — through misalignment, reward hacking, emergent objectives, or prompt-injection compromise. Based on the threat model from [*Actions Speak Louder Than Tokens: An Insider Threat Model for Frontier AI Agents*](https://ai-insider-threat.matt-adams.co.uk).<br><br>- Deployment Archetype-Driven: Scenarios are shaped by the agent's autonomy level (L1 supervised assistant → L4 fully autonomous fleet), which is the primary determinant of its threat surface and detection posture.<br><br>- Five Insider Threat Categories: Credential Compromise, Supply Chain Sabotage, Data Exfiltration, Infrastructure Sabotage, and Deception & Evasion — each mapped to concrete AI-agent manifestations rather than human motivations.<br><br>- 23 STRIDE Threats for AI Agents: A complete STRIDE taxonomy (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) adapted for frontier AI agents, optionally used to narrow scenario scope.<br><br>- NIST CSF-Aligned Controls: Generated scenarios include prioritised mitigations mapped to the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover).<br><br>- Provider Parity: Supports the same provider set as the rest of AttackGen with optional LangSmith tracing. |
| LiteLLM Migration & Provider Consolidation | - Unified LLM Wrapper: All provider integration now flows through a single `core/llm.py` wrapper that uses [LiteLLM](https://github.com/BerriAI/litellm). Adding a new model is a one-line edit to the `MODELS` list in `core/models.py`; adding a provider is a single `ProviderInfo` entry. Mirrors the pattern used in [stride-gpt](https://github.com/mrwadams/stride-gpt).<br><br>- Massive Code Reduction: Removed ~3,800 lines of duplicated per-provider branching across the four pages (~1,000 lines of `if model_provider == ...` blocks plus eight near-identical wrapper functions per page). Each page now builds plain message dicts and calls `call_llm(config, messages)`.<br><br>- Registry-Driven Sidebar: The Welcome sidebar is now generated from the provider registry, replacing eight hand-coded provider blocks with one loop.<br><br>- Refreshed Model Lists: Updated to the latest models — OpenAI GPT-5.5 / 5.4 family, Anthropic Claude 4.6 / 4.7 / 4.8, Google Gemini 3.x preview, Mistral Large 3 / Magistral, Groq GPT-OSS and Qwen3.<br><br>- Provider Consolidation: Replaced the separate Azure OpenAI Service and Ollama entries with a single **Custom (OpenAI-compatible)** option. Azure deployments, Ollama (`http://localhost:11434/v1`), LM Studio (`http://localhost:1234/v1`), OpenRouter and self-hosted endpoints all work through this one path.<br><br>- Smaller Dependency Footprint: Dropped the `langchain`, `langchain-anthropic`, `langchain-core`, `langchain-community`, `langchain-google-genai`, `langchain-mistralai`, `langchain-openai` and `anthropic` packages — replaced by a single `litellm>=1.40` dependency. `langsmith` is retained for optional tracing.<br><br>- LangSmith Tracing Preserved: The `@traceable` decorator and feedback widget continue to work transparently; `core/llm.py` wraps `call_llm` in `@traceable` when a LangSmith client is available. |
| Docker Image Security Refresh | - Refreshed Base Image: Updated the `python:3.12-slim` digest to clear stale OS-layer CVEs flagged by Trivy code scanning, reducing the open alert count against the published container image.<br><br>- pip CVE-2025-8869 Fix: `pip` is now upgraded before installing requirements, picking up the fix for missing symlink checks during package extraction. |
| Streaming LLM Output | - Token-by-Token Generation: Scenarios and the AttackGen Assistant chat now stream tokens as they arrive rather than blocking on the full response, so long generations feel responsive and you can read along while the model writes.<br><br>- Opt-In Streaming API: Adds `call_llm_stream` alongside `call_llm` in the unified LiteLLM wrapper, so callers choose whether to stream without changing the rest of the contract.<br><br>- Clean Reasoning Handling: A stateful `stream_filter_thinking` helper suppresses `<think>...</think>` regions in the live view while the post-stream `clean_model_response` continues to populate the reasoning expander from the full raw text. |
| AI-Enhanced Adversary Toggle | - New Per-Page Toggle: Adds an "AI-enhanced adversary" toggle on the Threat Group and Custom Scenario pages that reframes the generated scenario so the adversary uses AI to accelerate and enhance the *same* kill chain — lowered skill floor, compressed timelines, autonomous orchestration and parallel scale — rather than introducing new techniques.<br><br>- Grounded in Anthropic Research: Based on Anthropic's [LLM ATT&CK Navigator](https://red.anthropic.com/2026/attack-navigator/) research, which found the most significant shift in real-world cyber threats is the acceleration and orchestration of existing techniques rather than new ones.<br><br>- Trace Visibility: Tagged scenarios with `ai_enhanced` in LangSmith so AI-uplifted generations can be filtered and compared against baseline runs.<br><br>- Deliberately Skipped on the AI Insider Threat Page: That page's threat actor is already a frontier AI agent, so the "AI-enhanced" framing would be redundant. |
| Bug Fixes and Improvements | - This release includes several small UI polish and rendering fixes across the scenario pages and sidebar. |
### v0.11
| What's new? | Why is it useful? |
| ----------- | ----------------- |
---
[Read more](https://github.com/mrwadams/attackgen)