Known malicious kitlowother
Decepticon consoles reachable from the internet
family: decepticon-console-2026-11
Short link:scanmalware.com/h/360
Tracks internet-reachable consoles of Decepticon, an open-source platform in which AI agents run red-team engagements on their own. Threat researchers list it among the AI pentest frameworks exposed on the internet. Matches the console's full default title and the project's icon. A match identifies the software, not how it is used: the project is also used for authorized testing.
Anchors
SMQL queryrun
title:"Decepticon — Autonomous Red Team Platform" OR favicon_hash:-1814445533Provenance
Added: 2026-11-10 23:30
The console usually listens on port 3000. In its local mode it opens without a sign-in page, so a sighting can show its dashboard. The name is also a fictional faction, so the hunt matches the full title and not the word alone. A build that changes the title and the icon is not covered. Confirm unauthorized use before treating a sighting as hostile.