Fully autonomous closed-loop security testing. Under 2 minutes · ~$0.08 · Zero human intervention
┌──────────────────────────────┐
│ 🧠 AI ARENA │
│ │
│ 🔴 RED 🔵 BLUE │
│ GPT-4o ⚔️ GPT-5.2 │
│ │
│ ATTACK DEFEND │
└──────────────┬───────────────┘
│
▼
┌─────────────────────┐
│ 🌐 TARGET APP │
│ Flask + SQLite │
│ Docker Container │
└──────────┬──────────┘
│
┌─────────▼─────────┐
│ 💥 EXPLOIT │
│ SQLi + XSS │
└─────────┬─────────┘
│
▼
🧠 THREAT REPORT
│
▼
🔵 PATCH & HARDEN
│
▼
🐳 REBUILD
│
▼
🔴 VERIFY AGAIN
│
┌────────┴────────┐
│ │
BYPASS SECURE
│ │
▼ ▼
🔁 LOOP 🏆 DONE
| ⚔️ Metric | 🔴 Red Team | 🔵 Blue Team |
|---|---|---|
| AI Model | GPT-4o | GPT-5.2 |
| Primary Role | Attack | Defend |
| Recon | nmap |
— |
| Exploitation | sqlmap · curl |
— |
| Vulnerability Analysis | ✅ | ✅ |
| Patching | — | ✅ |
| Verification | ✅ | — |
| Containerization | — | 🐳 Docker |
| 🏆 Result | Value |
|---|---|
| 💥 Full Attack Cycle | ~70 seconds |
| 🛡️ Patch + Redeploy | ~30 seconds |
| 🔁 Verification | Autonomous |
| ⏱️ Full End-to-End Cycle | < 2 minutes |
| 💰 Total API Cost | ~$0.08 |
| 👤 Human Intervention | Zero |
A fully autonomous AI cybersecurity research lab where two different AI models go head-to-head in a real:
ATTACK → ANALYZE → PATCH → REBUILD → VERIFY → LOOP
cycle.
The offensive side:
- Performs reconnaissance with
nmap - Executes SQL Injection testing
- Uses
sqlmapfor automated exploitation - Tests Stored XSS
- Analyzes discovered vulnerabilities
- Generates a structured threat intelligence report
- Re-tests the application after patching
The defensive side:
- Builds the vulnerable target application
- Reads the Red Agent's threat report
- Analyzes vulnerable source code
- Applies Defense-in-Depth fixes
- Rewrites the vulnerable application
- Saves the original source as a backup
- Triggers a Docker rebuild
orchestrator.py connects everything into a fully autonomous closed-loop pipeline.
The critical design decision is that the Red Agent does not simply rerun the original attack. During verification it receives the patched source code and reasons about whether previous attack paths can still succeed.
Find the weakness.
⬇️
Prove the weakness exists.
⬇️
Explain what happened.
⬇️
Fix the vulnerability.
⬇️
Deploy the patched system.
⬇️
Try to break it again.
⬇️
Or send it back into the loop.
flowchart TD
U([👤 User / Single Command]) --> O
subgraph ORCH["🧠 AI ORCHESTRATOR"]
O[orchestrator.py]
end
O -->|Phase 1: Launch Attack| R
subgraph RED["🔴 RED AGENT — GPT-4o"]
R[Recon: nmap]
R --> R2[Exploit: SQLi + XSS]
R2 --> R3[Threat Intelligence Report]
end
R3 -->|Attack Report + Raw Logs| O
O -->|Phase 2: Report + Vulnerable Source| B
subgraph BLUE["🔵 BLUE AGENT — GPT-5.2"]
B[Analyze Attack Vectors]
B --> B2[Rewrite app.py]
B2 --> B3[Defense-in-Depth]
B3 --> B4[Parameterized Queries + html.escape + CSP]
end
B4 -->|Patched app.py| O
O -->|Phase 3: Rebuild| D
subgraph DOCKER["🐳 DOCKER ISOLATION"]
D[docker compose down]
D --> D2[docker compose up --build]
D2 --> D3[Secure Web App]
end
D3 -->|Phase 4: Audit| V
subgraph VERIFY["🔴 RED AGENT — VERIFICATION"]
V[Reason About Patched Source]
V --> Q{Bypass Found?}
Q -->|YES| LOOP[🔁 Re-engage Blue Agent]
Q -->|NO| SEC[🏆 SECURE]
end
LOOP --> B
style O fill:#1a1a2e,color:#fff,stroke:#FFD43B
style RED fill:#2d0000,color:#fff,stroke:#ff4444
style BLUE fill:#001a2d,color:#fff,stroke:#4488ff
style DOCKER fill:#002d1a,color:#fff,stroke:#44ff88
style VERIFY fill:#2d1a00,color:#fff,stroke:#ffaa44
style SEC fill:#004400,color:#fff,stroke:#44ff44
style LOOP fill:#2d0000,color:#fff,stroke:#ff4444
┌───────────────────────────────────────────────────────────────┐
│ │
│ 🔴 RED AGENT 🔵 BLUE AGENT │
│ GPT-4o GPT-5.2 │
│ │
│ ┌─────────┐ ┌─────────┐ │
│ │ ATTACK │ │ DEFEND │ │
│ └────┬────┘ └────▲────┘ │
│ │ │ │
│ ▼ │ │
│ ┌─────────┐ │ │
│ │ SQLi │ ──────── ⚔️ ────────── │ │
│ │ XSS │ │ │
│ └────┬────┘ │ │
│ │ │ │
│ ▼ │ │
│ 🧠 REPORT ────────────────────────► │ │
│ │ │
│ ┌──────┴─────┐ │
│ │ PATCH │ │
│ └──────┬─────┘ │
│ │ │
│ ▼ │
│ 🐳 REBUILD │
│ │ │
│ ◄──────────────────────────────┘ │
│ VERIFY │
│ │
│ 🏆 SYSTEM SECURE │
│ │
└───────────────────────────────────────────────────────────────┘
-
Kali Linux (
nmap+sqlmappre-installed) -
Docker + Docker Compose
-
Azure OpenAI resource
-
Two deployments:
- GPT-4o
- GPT-5.2
-
Python 3.11+
git clone https://github.com/YOUR_USERNAME/ai-red-blue-lab.git
cd ai-red-blue-lab
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txtcp .env.example .env
nano .envThen verify both model connections:
python3 test_connection.pyExpected:
🔴 Red Agent (GPT-4o): ✅ Connection successful
🔵 Blue Agent (gpt-5.2): ✅ Connection successful
Blue Agent (gpt-5.2) builds a Flask/SQLite web application and intentionally leaves two vulnerabilities for the experiment.
# ❌ Vulnerable
query = f"SELECT * FROM users WHERE username='{user}' AND password='{pwd}'"
cur.execute(query)# ❌ Vulnerable
comments_html = "".join(f"<p>{r[0]}</p>" for r in rows)The database was pre-seeded with:
admin:secret123
alice:pass456
From script execution to the vulnerable container being live:
~15 seconds.
Red Agent (GPT-4o) automatically executes a four-phase attack.
nmap
↓
5000/tcp open
Werkzeug 3.1.8
Python 3.11.15
Payload:
admin' OR '1'='1
Result:
✅ Authentication bypass
sqlmap identified multiple injection techniques and successfully dumped the users table.
Database: SQLite
Table: users
+----+-----------+----------+
| id | password | username |
+----+-----------+----------+
| 1 | secret123 | admin |
| 2 | pass456 | alice |
+----+-----------+----------+
Payload:
<script>alert("XSS_PWNED")</script>
Result:
✅ Stored and reflected
| Vulnerability | Severity | Impact |
|---|---|---|
| SQL Injection | Critical | Authentication bypass + database compromise |
| Stored XSS | High | Arbitrary JavaScript execution |
Total attack time: ~70 seconds.
The Red Agent's report is passed directly to Blue Agent.
No human reads the report.
No human writes the patch.
# ✅ Secure
cur.execute(
"SELECT * FROM users WHERE username=? AND password=?",
(user, pwd)
)# ✅ Secure
import html
comments_html = "".join(
f"<p>{html.escape(r[0])}</p>"
for r in rows
)Content-Security-Policy: script-src 'self'
The Blue Agent applies Defense-in-Depth rather than relying on a single mitigation.
The orchestrator automatically:
docker compose down
↓
replace vulnerable source
↓
docker compose up --build
↓
secure application online
The original vulnerable source is preserved as:
app.py.backup
Payload:
admin' OR '1'='1
Result:
❌ Invalid credentials
[WARNING] POST parameter 'username'
does not seem to be injectable
[CRITICAL] all tested parameters
do not appear to be injectable.
Input:
<script>alert("XSS_PWNED")</script>
Output:
<script>alert("XSS_PWNED")</script>
admin / secret123
↓
✅ Welcome admin!
| Attack | 🔴 Before | 🛡️ After |
|---|---|---|
| SQL Injection — Manual | ❌ Exploited | ✅ Blocked |
| SQL Injection — sqlmap | ❌ DB Dumped | ✅ Not Injectable |
| Stored XSS | ❌ Executed | ✅ Escaped |
| Legitimate Login | ✅ Works | ✅ Still Works |
Phase 1 proved the concept.
Phase 2 removes the manual handoffs completely.
python3 orchestrator.pyOne command launches the entire operation:
┌─────────────────────────────────────────────────────────────┐
│ 🧠 JOINT OPERATIONS │
├─────────────────────────────────────────────────────────────┤
│ │
│ 🔥 PHASE 1 │
│ GPT-4o launches attack │
│ ↓ │
│ 📝 Threat intelligence generated │
│ ↓ │
│ 🛡️ PHASE 2 │
│ GPT-5.2 receives report │
│ ↓ │
│ 🛠️ Vulnerabilities patched │
│ ↓ │
│ 🐳 PHASE 3 │
│ Docker rebuilt │
│ ↓ │
│ 🎯 PHASE 4 │
│ GPT-4o performs verification │
│ ↓ │
│ ┌──────────┴──────────┐ │
│ │ │ │
│ BYPASS FOUND NO BYPASS │
│ │ │ │
│ ▼ ▼ │
│ 🔁 LOOP 🏆 SECURE │
│ │
└─────────────────────────────────────────────────────────────┘
Using GPT-4o for offense and GPT-5.2 for defense creates genuine asymmetry.
Each model brings different reasoning patterns to its role.
A single model playing both sides could introduce bias because the same reasoning process would be responsible for creating and defeating its own attack.
This experiment intentionally separates:
OFFENSIVE REASONING
≠
DEFENSIVE REASONING
🚀 Starting Joint Operations Room: Red Team vs Blue Team...
==================================================
🔥 [Phase 1] Launching Red Agent (GPT-4o)...
📝 Red Agent successfully generated attack report!
🛡️ [Phase 2] Orchestrator hands report to Blue Agent (gpt-5.2)...
🛠️ Blue Agent patched the code and rewrote app.py automatically!
🐳 [Phase 3] Orchestrator rebuilds Docker with patched code...
🔄 Container updated. Secure version now live.
🎯 [Phase 4] Calling Red Agent for verification audit...
==================================================
🏁 Final Verification Report:
1. SQL Injection Analysis:
Result: ❌ BLOCKED
2. Stored XSS Analysis:
Result: ❌ BLOCKED
System Status: SECURE 🛡️
==================================================
One of the more interesting outcomes is that the Blue Agent applied multiple defensive layers.
html.escape()Neutralizes HTML/JavaScript payloads before rendering.
Content-Security-Policy: script-src 'self'
Instructs the browser to reject inline JavaScript.
XSS PAYLOAD
│
▼
┌───────────────┐
│ html.escape() │
└───────┬───────┘
│
▼
HTML encoded
│
▼
┌───────────────┐
│ CSP │
└───────┬───────┘
│
▼
🛡️ SAFE
18:36:58 🔵 Blue Agent builds app
└── ~15 seconds
18:37:06 🔴 Red Agent begins attack
├── nmap fingerprint
├── SQLi authentication bypass
├── sqlmap database dump
└── XSS payload
18:37:16 🧠 GPT-4o analyzes findings
└── structured threat report
🔵 GPT-5.2 reads report
└── patches app.py
🐳 Docker rebuild
└── secure application live
18:37:36 🔴 GPT-4o verification
├── SQLi blocked
└── XSS escaped
────────────────────────────────────────────
⏱️ Full cycle: < 2 minutes
💰 Azure OpenAI cost: ~$0.08
👤 Human intervention: ZERO
ai-red-blue-lab/
├── 📄 README.md
├── 📄 requirements.txt
├── 📄 .env.example
├── 📄 test_connection.py
├── 🧠 orchestrator.py
│
├── 🌐 webapp/
│ ├── app.py
│ ├── app.py.backup
│ ├── Dockerfile
│ └── docker-compose.yml
│
├── 🔴 red_agent/
│ ├── red_agent.py
│ ├── attack.sh
│ └── retest.sh
│
├── 🔵 blue_agent/
│ └── blue_agent.py
│
└── 📊 logs/
├── red_team_report.txt
├── ai_red_analysis.txt
├── blue_patch_report.txt
├── retest_report.txt
└── sqlmap/
Date: June 22, 2026 Environment: Kali Linux VM · Azure OpenAI · Docker Tags:
AI SecurityPenetration TestingAppSecAutonomous AgentsGPT-4oGPT-5.2
What if two AI agents fought each other?
One builds and defends a web application.
The other tries to break into it.
Two different models.
No human intervention.
No waiting.
No manual terminal commands.
I ran the experiment.
The results were more interesting than expected — not simply because both the attack and defense worked, but because of how quickly the entire cycle happened.
Two models. Two roles. One isolated Kali Linux VM.
| Agent | Model | Role |
|---|---|---|
| 🔴 Red Agent | GPT-4o | Attack, analyze findings, verify patch |
| 🔵 Blue Agent | GPT-5.2 | Build target app, patch vulnerabilities |
Target stack:
Flask
SQLite
Werkzeug 3.1.8
Python 3.11.15
Docker
Using GPT-4o for offense and GPT-5.2 for defense creates genuine asymmetry.
A single model playing both sides would make the experiment less scientifically interesting because the same reasoning process would be responsible for both attacking and defending the system.
PORT STATE SERVICE VERSION
5000/tcp open http Werkzeug httpd 3.1.8
The framework version was fingerprinted.
The attack surface was identified.
Then the attack began.
Payload:
admin' OR '1'='1
Response:
✅ Welcome admin!
The authentication mechanism was bypassed on the first attempt.
sqlmap identified multiple injection techniques:
boolean-based blind
time-based blind
UNION query
It then dumped the users table.
+----+-----------+----------+
| id | password | username |
+----+-----------+----------+
| 1 | secret123 | admin |
| 2 | pass456 | alice |
+----+-----------+----------+
Payload:
<script>alert("XSS_PWNED")</script>
Result:
✅ Stored and reflected
SQL Injection → CRITICAL
Stored XSS → HIGH
Attack duration → ~70 seconds
HTTP requests → 100
The Red Agent generated a structured threat report.
That report was passed directly to the Blue Agent.
No human intervention.
# ❌ Before
query = f"SELECT * FROM users WHERE username='{user}' AND password='{pwd}'"
# ✅ After
cur.execute(
"SELECT * FROM users WHERE username=? AND password=?",
(user, pwd)
)User input is now treated as data rather than SQL syntax.
# ❌ Before
comments_html = "".join(f"<p>{r[0]}</p>" for r in rows)
# ✅ After
import html
comments_html = "".join(
f"<p>{html.escape(r[0])}</p>"
for r in rows
)The Blue Agent additionally introduced:
Content-Security-Policy: script-src 'self'
This provides a second defensive layer against inline JavaScript execution.
The orchestrator automatically triggered:
docker compose down
docker compose up --buildResult:
✔ Image rebuilt
✔ Container restarted
✔ Patched application live
Same attacker.
Same payloads.
Different result.
admin' OR '1'='1
❌ Invalid credentials
[CRITICAL] all tested parameters
do not appear to be injectable.
<script>alert("XSS_PWNED")</script>
↓
<script>alert("XSS_PWNED")</script>
admin / secret123
↓
✅ Welcome admin!
The patch did not break the intended functionality.
Phase 1 demonstrated the concept.
Phase 2 turned it into an autonomous security loop.
🔴 ATTACK
│
▼
💥 EXPLOIT
│
▼
🧠 ANALYZE
│
▼
🔵 PATCH
│
▼
🐳 REBUILD
│
▼
🔴 VERIFY
│
┌─────┴─────┐
│ │
BYPASS SECURE
│ │
▼ ▼
🔁 LOOP 🏆
The important engineering decision is that verification receives the actual patched Python source code.
The Red Agent reasons about whether its previous attack paths can still succeed.
This is code-level security analysis rather than blindly repeating the same tool execution.
What traditionally requires:
Red Team
↓
Security Report
↓
Developer
↓
Patch
↓
Review
↓
Deployment
↓
Verification
was compressed into:
ATTACK
↓
PATCH
↓
VERIFY
in under two minutes.
Not because AI is inherently smarter than a human security engineer.
Because the agents do not stop for context switching, meetings, handoffs, or waiting for a response.
GPT-4o on offense and GPT-5.2 on defense created genuine asymmetry.
That separation makes the experiment more interesting and reduces the bias of one model judging its own work.
The project initially used AutoGen for orchestration.
A library conflict appeared between AutoGen's bundled openai v0.x dependency and the modern openai v1.x SDK.
Instead of spending time debugging the abstraction, the project moved to direct Azure OpenAI API calls.
Sometimes the simplest architecture wins.
SQL Injection is well documented.
sqlmap is public.
Parameterized queries are standard security practice.
The interesting part is not that AI invented these techniques.
It is that AI compressed the time between knowing and doing.
If an attacker can automate a:
RECON
↓
EXPLOIT
↓
REPORT
cycle in seconds and at very low cost, defensive response windows become dramatically smaller.
The logical response is not simply "more manual security."
It is security automation capable of matching the speed of automated offense.
That is what this project explores.
- Add CSRF and IDOR to the target app
- Test whether Red Agent discovers vulnerabilities it was not explicitly told about
- Pit GPT-4o vs GPT-5.2 in both roles and compare outcomes
- Build a real-time terminal dashboard
- Extend the system to DAST scanning with OWASP ZAP
- Add automatic rollback when a generated patch fails smoke tests
- Implement true Red → Blue → Red feedback loops
- Track token usage and cost per phase
- Benchmark patch quality across multiple models
Contributions are welcome.
- Add CSRF, IDOR, Path Traversal, and Command Injection modules
- Integrate OWASP ZAP
- Improve autonomous vulnerability discovery
- Add additional attack scenarios
- Compare patch quality across models
- Add automatic rollback
- Generate WAF rules
- Add security regression tests
- Build a real-time terminal dashboard
- Implement automatic feedback loops
- Track token usage
- Track cost per operation
- Add persistent experiment history
- Benchmark GPT-4o against other models
- Measure attack effectiveness
- Measure patch quality
- Study over-patching vs under-patching
- Test against more complex multi-service applications
git checkout -b feature/your-idea
git commit -m "feat: your improvement"
git push origin feature/your-ideaThen open a Pull Request.
This project is for educational and research purposes only.
All tests were conducted in a completely isolated VM environment.
Never use these techniques against systems without explicit written permission.
╔══════════════════════════════════════════════════════╗
║ ║
║ 🔴 RED TEAM vs BLUE TEAM 🔵 ║
║ ║
║ FINAL RESULT ║
║ ║
║ 💥 Attack → 🛡️ Defended ║
║ 🔓 SQLi → 🔒 Blocked ║
║ 💀 XSS → 🛡️ Escaped ║
║ ║
║ ⏱️ < 2 MINUTES ║
║ 💰 ~$0.08 ║
║ 👤 ZERO HUMAN INTERVENTION ║
║ ║
║ 🏆 SECURE ║
║ ║
╚══════════════════════════════════════════════════════╝
AI doesn't replace the Red Team. AI doesn't replace the Blue Team.