AI Pentesting Tool ‘Villager’ Merges Kali Linux with DeepSeek AI for Automated Security Attacks

Security researchers at Straiker’s AI Research (STAR) team have uncovered Villager, an AI-native penetration testing framework developed by Chinese-based group Cyberspike, which has already accumulated over 10,000 downloads within two months of its release on PyPI. The tool merges Kali Linux toolsets with DeepSeek AI models to fully automate penetration testing workflows, raising concerns about dual-use abuse and the potential for threat actors to replicate Cobalt Strike-like capabilities.

Villager operates as a Model Context Protocol client that coordinates via an MCP client service on port 25989 and leverages a database of 4,201 AI system prompts to generate exploits and guide real-time decisions. It also features on-demand containerised Kali environments with 24-hour self-destruct mechanisms, designed to wipe activity logs and hinder forensic analysis, and uses natural language processing to orchestrate complex attack chains.

The project is led by @stupidfish001, a former CTF player, with code and dependencies maintained through hscsec[.]cn and cyberspike[.]top domains, according to the article. Villager’s emergence signals a shift towards AI-driven, autonomous attack tooling that could shorten attack lifecycles and complicate detection and response efforts.