ThreatBook has introduced RedAgents, a cloud service that aggregates multiple AI-driven penetration-testing agents to evaluate an organization’s systems.
Announced on October 16, 2026, the platform is intended to help security teams discover weaknesses in their own networks by running several automated tests within a defined, authorized scope.
According to ThreatBook, the agents can run in parallel and present findings and test logs in a single interface. RedAgents is presented as an alternative to relying on a single testing tool or provider.
Each agent may look for different kinds of issues, so combining their outputs could give defenders a broader view of potential exposure.
The launch statement frames RedAgents as a software-as-a-service platform for security operations teams, not as a description of new malware or a report on a particular intrusion.
ThreatBook says the platform brings together agents with varied origins and capabilities. The agents named at launch are Artex Pro, Cyber(YanJi), Yanxun and CyberStrikeAI Enterprise Edition.
Teams can select a single agent or run several against the same approved target, then review consolidated results through a shared interface.
ThreatBook launches RedAgents AI platform
RedAgents functions as an aggregator that connects multiple AI penetration-testing agents and can execute them concurrently. Penetration testing is an authorized evaluation in which testers search for vulnerabilities before attackers can exploit them.
Running agents side by side can help surface issues one tool might miss, although the usefulness of results depends on how accurately each agent tests and reports findings.
ThreatBook says the platform consolidates findings, test data and logs into a unified view, which could reduce the need to transfer information between separate tools.
While similar in concept to using multiple scanners or testing teams, RedAgents is designed specifically to coordinate AI agents as part of a single assessment.
For context, Cybersecurity News has previously covered a multi-agent pentesting toolkit that assigns different tasks to specialist agents.
The four agents named at launch have distinct backgrounds. ThreatBook describes Artex Pro as the enterprise version of Artex, an autonomous penetration-testing agent. Cyber(YanJi) is a Python-based agent that searches for a route from a starting point to a defined goal.
Yanxun is described as a coordinator for specialist agents, while CyberStrikeAI Enterprise Edition is based on an AI-native testing tool ThreatBook acquired in September 2026.
These characterizations are taken from the company’s announcement and should be read as vendor claims rather than independent, comparative test results.
For example, ThreatBook reports that Yanxun can coordinate several dozen agents and that Cyber(YanJi) solved 54 of 54 challenge problems during a validation event, but the release does not include a controlled, side-by-side benchmark showing how all four agents perform against the same targets.
Scope and data controls
Automated testing can cause disruption if it probes systems without permission or exceeds an agreed scope. ThreatBook says RedAgents lets customers define an allowlist of approved targets and requires agents to operate within those authorized limits.
Organizations should still confirm scope, timing, rate limits and test conditions before running any penetration test, particularly on systems that support business operations.
ThreatBook also states that customer test data remains inside the ThreatBook environment and is not sent to third-party agents. RedAgents supports Zero Data Retention (ZDR), which the company describes as enabling complete deletion of test data.
Security teams should verify how these controls work in practice — including retention periods, access permissions, logging and contractual terms — before submitting sensitive environment details.
The launch comes as more security products use AI agents to automate parts of testing. Other examples covered by Cybersecurity News include PentestCode’s AI testing agent and Xalgorix’s verification-focused platform.
These products vary in deployment models and how they present findings, so teams should compare scope controls, evidence quality and data handling rather than treating “AI pentesting” as a single, uniform category.
The main promise of RedAgents is breadth: multiple agents may explore a target in different ways and provide a combined view of possible weaknesses.
That does not guarantee every result is valid or that every vulnerability will be found. Security staff still need to review evidence, reproduce important findings safely and prioritize fixes based on business impact and exposure.
ThreatBook says the platform can reduce false positives by correlating agent results, but the announcement does not publish independent accuracy metrics or a quantified false-positive rate.
The release likewise does not cite a named customer deployment, a measured security outcome, or external validation of the service — details that will matter to organizations evaluating whether the platform fits their testing process.
For further context, Cybersecurity News has also reported on Apex’s black-box testing approach, which evaluates applications without access to source code.
RedAgents’ distinguishing characteristic is not a single testing method but a central platform for selecting and coordinating several agents. ThreatBook says it plans to add more open-source agents over time alongside the enterprise tools available at launch.
Further product details appear in the company’s announcement and the RedAgents product blog. ThreatBook says organizations can request a trial through its website.
Indicators of compromise (IoCs):
| IoC type | Value |
|---|---|
| Malware name | Not reported |
| File hash / SHA value | Not reported |
| Domain or IP address | Not reported |
| Other indicators | Not reported |
Note: IP addresses and domains are intentionally defanged (for example, using “[.]”) to prevent accidental resolution or hyperlinking. Re-fang only inside controlled threat-intelligence platforms such as MISP, VirusTotal, or your SIEM.
Update defenses against new malware as soon as it appears. Integrate TI feeds with data from 16K SOCs.
