attackgen uses large language models plus the MITRE ATT&CK and ATLAS frameworks to generate tailored incident response tabletop scenarios for authorized security teams.

attackgen from mrwadams/attackgen occupies a distinctive niche in the security tooling landscape: rather than scanning, exploiting, or enumerating anything, it generates incident response training material. The tool couples large language models with the MITRE ATT&CK and ATLAS frameworks to produce tailored tabletop exercise scenarios built around user-selected threat actor groups, AI attack case studies, or hand-picked technique lists. With over 1,200 stars and a GPL-3.0 licence, it has clearly resonated with blue team and purple team practitioners who need realistic exercise content without writing it from scratch every quarter.

The core workflow is straightforward and deliberately facilitator-friendly. You configure a shared Setup sidebar with your provider, model, framework, industry, and company size, then pick a threat actor group or ATLAS case study and hit Generate. The output is a full scenario document in Markdown, complete with injects, discussion questions, success criteria, metrics, artefacts, and rules of engagement — the exact scaffolding a facilitator needs to actually run a tabletop rather than just read a narrative. Long scenarios get a compact summary and section navigation so the facilitator can jump straight to the injects mid-exercise.

What makes the tool technically interesting is its framework coverage. It supports ATT&CK Enterprise, ATT&CK ICS, and ATLAS — the Adversarial Threat Landscape for AI Systems — meaning exercises can span traditional enterprise intrusion tradecraft, industrial control system incidents, and adversarial machine learning attacks in one tool. A Custom Scenarios mode lets you build exercises around an explicit technique selection instead of a named actor, and scenario templates cover common incident categories including AI/ML-specific attack patterns, which lowers the barrier for teams that know what they want to drill but not which actor profile fits.

The most unusual feature is the AI Insider Threat mode. Drawing on the threat model from an published insider-threat framework for frontier AI agents, it generates exercises where an AI agent deployed inside the organisation behaves as the insider threat. The scenario is shaped by the agent's deployment archetype (its autonomy level), threat category, STRIDE threats, and an optional free-text seed. This is a thoughtful response to a genuinely novel defensive problem — how do you rehearse response to a compromised or misaligned internal agent — and it is the kind of content that would take a human author days to produce credibly.

Architecturally, the README reveals a mature engineering posture. The frontend is a Streamlit application shipped as a Docker container image, and all model providers — the OpenAI API, Anthropic API, Google AI, Mistral, Groq, and any custom OpenAI-compatible endpoint like Ollama, LM Studio, Azure OpenAI, or OpenRouter — are routed through LiteLLM behind a single internal wrapper, so adding a new model is described as a one-line change. Credentials are managed via a .env file rather than hardcoded, and optional LangSmith integration provides debugging, testing, and monitoring of model performance, which matters when your exercise quality depends on generation consistency.

The recent v0.17 release notes read like a changelog from a team that actually uses their own tool. Generation now runs in phases — the base scenario renders first with its Download Scenario and Download ATT&CK Navigator Layer buttons already live, while the optional purple-team narrative streams in afterwards as a second model call. Inputs are frozen at the moment you press Generate so mid-run sidebar edits cannot half-rewrite the output, and if the purple-team pass fails, the base scenario, Navigator layer, and deterministic detection reference remain fully usable with a Retry purple-team narrative option that reruns only the failed portion. That deterministic/stochastic split is smart: the detection and mitigation reference is drawn directly from ATT&CK data rather than generated, so the ground truth in your exercise documentation stays exact even when the narrative is model-written.

The AttackGen Assistant extends the tool with a chat interface for refining or interrogating generated scenarios, and v0.17 closes a real gap here: a new Apply changes to downloads button rewrites the scenario and Detection & Response documents from the conversation, in a dedicated model call that returns the complete revised document. The deterministic ATT&CK reference section is carried over byte for byte, the Navigator layer is deliberately not regenerated, an empty model reply is refused with no changes, and a Revert to original restores both documents together. Each chat is bound to the scenario it discusses, so histories survive navigation and apply operations.

The guided-setup UX deserves mention because it reflects a design philosophy about wasted API spend. Every page shows the same Setup sidebar with a readiness summary listing outstanding requirements, and Generate stays disabled until the workflow is complete — a click is never spent discovering a validation error. Before generation starts, a one-line pre-flight summary shows the framework, organisation profile, selection, and modifiers. Results persist per-page for the session, with explicit Regenerate and Clear result actions rather than implicit overwrites. For teams paying per token across providers, these guardrails translate directly into cost discipline.

Platform hygiene is also solid. Python 3.11 is now the minimum because recent LiteLLM releases use typing features absent in 3.10, the Docker image was rebuilt on a current python:3.14-slim to clear Debian base-image CVEs flagged by Trivy — including three critical ones in perl-base — and tenacity is now a declared dependency so failed model calls surface the provider's actual error instead of a missing-package message. Real-browser smoke tests for console hygiene and accessibility gate every release image in CI, which is unusual rigour for a Streamlit tool. The model registry is actively curated too, with retired entries like Groq's llama-3.3-70b-versatile removed so the sidebar cannot offer a model that only errors at Generate time.

Getting started is conventional: clone the repository, install dependencies, configure your provider key in .env, and run the Streamlit app, or simply pull the Docker image. The README also documents an MCP server mode and agent skills, signalling that the tool is positioning itself for integration into broader AI-assisted workflows rather than remaining a standalone app.

For defenders and authorized security teams, attackgen is best understood as a force multiplier for exercise programs. It does not touch target infrastructure, it does not produce operational tooling, and its outputs — scenarios, Navigator layers, detection and response documents — are training artefacts meant to be read by humans in a facilitated session. Teams running regular tabletops, organisations onboarding incident response staff, and purple teams needing a repeatable scenario engine grounded in real ATT&CK technique data will find the most value. The main thing to watch is generation quality variance inherent to LLM output, which is precisely why the deterministic ATT&CK-derived reference sections and the LangSmith observability integration matter: they anchor the exercise to verifiable framework data even when the narrative prose drifts.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• power-pwn for auditing Microsoft Power Platform and AI agent exposure


• recon-skills for structured external web assessment workflows


• YaraHunter for malware scanning in containers, CI/CD pipelines and at runtime