Security & Threat Intelligence · 25.07.2026, 15:29 UTC
Disposable Tooling: Building LLM-Generated Mythic Agents from Prompt to Deployment
| Schweregrad | info |
|---|---|
| Kategorie | Security & Threat Intelligence |
| Quelle | SpecterOps ↗ |
| Veröffentlicht | 25.07.2026 UTC |
Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.
An area I’ve been very interested in exploring over the past several months is the generation of what I have been calling “disposable tooling”. With the development space now discussing the reduced cost of writing code, the idea is to also explore how offensive tooling can be brought closer to the paradigm that appeared when cloud-infrastructure era popularized the phrase “treat servers as cattle and not pets”.
In this post I will walk through each major milestone that has been taken in my quest to explore this objective by building LLM-generated Mythic agents from prompt to deployment. Starting at the beginning, I’ll show what worked, what didn’t, and where this space is likely going next.
Apfell Died so Mythic Could Live
One of the core principles of Mythic since the evolution from Apfell in 2020 was to decouple agent development from the underlying C2 architecture.
At the time, many knew the name “Apfell” as the C2 framework for macOS engagements. So the idea of taking this framework and distilling it down into one component of a larger framework was a radical deviation from the norm. And this has gone on to be a core reason for Mythic’s success, with many red teams building private agents which integrate into Mythic’s ecosystem.
This meant that when Large Language Models became proficient in generating code with little supervision, it was the obvious place to start when I wanted to experiment with generating new Mythic agents using LLMs.
The aim I set myself was simple, could I one-shot a new agent from initial prompt to deployment? In other words: no human in …